-
CVE-2025-33255: About NVIDIA TensorRT-LLM (22nd May 2026)
Preface: DeepSpeed MII, an open-source Python library developed by Microsoft, aims to make powerful model inference accessible, emphasizing high throughput, low latency, and cost efficiency. TensorRT LLM, an open-source framework from NVIDIA, is designed for optimizing and deploying large language models on NVIDIA GPUs. Background: TensorRT-LLM is a library developed by NVIDIA to optimize and…
-
CVE-2026-24207: About NVIDIA Triton Inference Server (21st May 2026)
Preface: The NVIDIA Triton Inference Server natively supports gRPC as one of its primary communication protocols for the client API. Furthermore, gRPC can also be used for health checks, statistics, and model loading/unloading operations, not just inference requests. Inference requests arrive at the server via either HTTP/REST or GRPC or by the C API and…
-
CVE-2026-8836: A vulnerability was found in lwIP up to 2.2.1. (20th May 2026)
Preface: IoT manufacturers are very willing to use lwIP (Lightweight IP) in firmware, and it is widely used in commercial IoT products. It is a dominant TCP/IP stack in the embedded space because it provides a full-featured networking stack (TCP, UDP, DHCP, DNS) while being highly optimized for resource-constrained, low-power devices. Even though firmware allocate…
-
The connection to suspected unidentified phenomena in the sky – my hypothesis is ER=EPR (11th May 2026)
Preface: I am applying the concept that “spacetime is woven by entanglement” to a localized atmospheric setting. If entanglement can alter spatial connectivity, an “entangled cloud” would indeed behave as a region with anomalous physical properties. Background: If there were a large amount of quantum-entangled hydrogen gas in the atmosphere at normal temperature and pressure,…
-
The Tang Dynasty understood the composition of the moon earlier than modern astronauts. (19th May 2026)
Preface: This story, from *Youyang Zazu: Tianzhi* ((酉陽雜俎: 天咫), recounts how a Tang Dynasty scholar, lost in the Songshan Mountains (嵩山), encountered a “moon man 《修月人》” repairing the moon. The character describes the moon as a sphere composed of seven precious materials and suggests that the light and shadow on its surface are caused by…
-
CVE-2026-46300 (Fragnesia) is a Linux kernel privilege escalation in the XFRM ESP-in-TCP subsystem. Does it affect GX-grade supercomputers? (18th May 2026)
Preface: If BlueField DPU supports configuring IPsec rules using strongSwan 5.9.0bf, does it use kernel IPsec in ARM? Yes, when using strongSwan 5.9.0bf on the BlueField DPU, it utilizes the Linux kernel IPsec stack (xfrm) running on the ARM cores to manage and configure security associations, which can then be offloaded to the hardware acceleration…
-
A more imaginative assumption on TDXRay: Microarchitectural Side-Channel Analysis of Intel TDX for Real-World Workloads (15th MAY 2026)
Preface: In these scenarios (see attached diagram), microarchitecture side-channel attacks targeting Intel TDX can directly impact and jeopardize the security of AMD accelerators. Even though the AMD Instinct APU operates on a completely different silicon package, the two architectures are fundamentally tied together by a shared software stack, device driver interface, and physical interconnect fabric.…
-
Checkmarx Jenkins AST Plugin Compromised (14th May 2026)
Preface: Jenkins’ popularity and its rich plugin ecosystem are the main reasons for integrating event monitoring tools with it. While there isn’t a single “API plugin,” Jenkins has a powerful built-in remote access API (supporting XML, JSON, and Python), which many external monitoring tools use to retrieve data. Background: With its unparalleled flexibility, vast plugin…
-
Shai-Hulud operates as a multi-vector, self-propagating worm. It routinely changes its entry points to compromise environments. Stay vigilant! (14th May 2026)
Preface: The TanStack incident was a highly sophisticated software supply-chain compromise that occurred on May 11, 2026. An attacker successfully hijacked TanStack’s legitimate GitHub Actions release pipeline to publish 84 malicious versions across 42 @tanstack/* npm packages, including widely used tools like @tanstack/react-router. Background: Both @tanstack/react-router and @tanstack/react-query are client-side frontend libraries and K8s is…
-
CVE-2026-43284: Dirty Frag tricks the IPsec/TCP stack into doing the “dirty work”(13th May 2026)
Preface: The “Dirty Frag” attack chains two separate flaws in the Linux kernel’s networking stack: one in the ESP(Encapsulating Security Payload) protocol used by IPsec and another in the RxRPC protocol used for the AFS distributed file system. If you do not use IPsec, disabling its modules removes one of the major attack paths. Background:…