sep 8, 2026
10 links from the engineering internet.
workerd v1.20260908.1 flattens its jsg struct field wrappers
the workers runtime keys struct field wrappers on the field type instead of on each field, then stores them in a flat array. it is a build-shape change rather than a runtime feature, and the same tag fixes the internal build for forks owned by org members.
llama.cpp b10858 fuses gelu and silu into the vulkan mul kernel
the vulkan backend runs a unary activation (gelu, sigmoid, silu, softplus) and the multiply that follows it as one shader, and still fuses when a view node sits between them. it recovers a 10 to 18 percent prompt-processing regression on qwen and gemma4 shapes.
llama.cpp b10864 stops evicting server checkpoints too early
the min-step spacing rule now applies only once the checkpoint list is full, and a checkpoint at the same token position is replaced instead of appended. short prompts keep their resume points, so hybrid and recurrent models stop re-prefilling from an older one.
nltk's streambackedcorpusview reads any file with pathsec on
the view calls builtins.open instead of nltk.pathsec.open, so a caller who controls fileid reads arbitrary local files even when nltk.pathsec.enforce is true. cvss 8.7, patched in 3.10.0, one of four nltk path advisories published the same day.
nltk verifies nothing about a corpus it just downloaded
checksums were only a pre-download status check, so the downloader moved the file into place with os.replace and extracted it without hashing what actually arrived. 3.9.3 computes sha-256 on the received file before extraction.
ivanti sentry auth bypass hands unauthenticated callers admin
cve-2026-83527 is an alternate path that skips authentication entirely and lands a remote attacker at administrative access. fixed in r10.8.2, r10.7.3 and r10.6.4, and it landed alongside a batch of other ivanti advisories that day.
ivanti endpoint manager mobile skips a permission check
cve-2026-18851 lets a remote caller who already holds ordinary credentials reach admin functionality because authorization is never enforced on the route. patched in 12.10.0.0, 12.9.0.2 and 12.8.0.4.
netis nx10 returns the admin password without a session
the sysinfo action on the web management interface hands the administrator password to an unauthenticated request, so anyone who can reach the router can then log in as admin. cvss 9.3, affecting firmware v4.0.1.5808 and v3.0.0.4142.
arm gpu userspace drivers free memory the gpu can still reach
cve-2026-9034 is a use-after-free an unprivileged process triggers through ordinary gpu work, webgl and webgpu included. it spans the bifrost, valhall and 5th gen architecture driver branches from r42p0 through r55p0.
yfexam derives its jwt secret from a username and the month
cve-2026-79575: the signing key is not random server-side state, it is computed from the username and the current month. anyone who knows both can recompute it and forge tokens for that user.