Fetching from the wire…
Infra2026-09-14 · source-backed
The bug: the ggml-cpu PCH force-included ggml-impl.h before ops.h, pulling in <new> and defining __cpp_lib_hardware_interference_size, so C++ kernels used CACHE_LINE_SIZE 256 while the C work-buffer sizing in ggml-cpu.c used the fallback 64. The rope work buffer came up short by (CACHE_LINE_SIZE/4 - 16) * n_threads * 4 bytes and corrupted the heap, crashing later in an unrelated function. The fix disables the PCH and removes the std::hardware_destructive_interference_size branch entirely. A constant that changes value based on include order is a category of bug I'd never have found.
Each link below shares sources, entities, or timing with this story.
vxcontrol/pentagi describes itself as a fully autonomous agent system for complex penetration testing, MIT, 3,082 forks, pushed September 10, with only 63 open issues at that scale. It trended alongside SnailSploit/Claude-Red, so offensive-security agents are moving as a categ...
Google's v2.4.0, September 11, carries two security-relevant changes in roughly 50 commits: a fetched agent card's interface URLs are pinned to the origin the card came from (#1418), closing a redirect path where a hostile card pointed an agent at a different service, and the...
v3.225.7 is almost entirely security and correctness backports: a breaking reduction of default JWT session max age to 14 days, gating organization API key creation behind the admin-api entitlement, redacting credentials from rejected PostHog host logs in the worker, and suppr...
A failed migration now stops at the error that caused it rather than starting anyway and surfacing later as a missing chat.timer_at column, which is the exact failure seen moving from 0.11.0 through 0.11.2 (GitHub). It also repairs chat branches on open, where a reply saved un...
Released today: computed columns refresh via refresh_column_async returning a job handle, and they work on remote tables. The breakage list matters more than the feature for anyone upgrading. Table existence is now manifest-authoritative, Python requires pydantic v2, Node requ...
Compaction is a summarization job that rarely needs the frontier model you're paying for, and until now it silently ran on whatever you'd selected. The same release adds a searchable @ picker for referencing other Agent Manager worktrees, sharing paths, branches and session ID...
MindPattern daily
One email a day at 7 AM. Sources and a take on every story. Unsubscribe anytime.