Nine vLLM flaws published at once, and the tenth is unfixed in yesterday's release
On 5 October the US National Vulnerability Database published nine CVEs against vLLM in a single batch, CVE-2026-105752 through CVE-2026-105760. All nine already have fixes — eight in 0.30.0, one in 0.28.0 — so this is a disclosure catching up with the code, not a zero-day. It is still worth half an hour if you run vLLM for more than one tenant. Eight of the nine carry an availability impact, and the pattern repeats: one ordinary-looking request reaches the shared EngineCore and takes the service down for everyone on the box. Three of those need no credentials at all. Two abuse request-level media_io_kwargs video options so the server decodes attacker-chosen frames (CVE-2026-105758, CVE-2026-105760), and one makes the Rust frontend's Prometheus middleware mint a fresh label set for every arbitrary HTTP method token sent at /tokenize until memory is gone (CVE-2026-105759). Nothing in the batch scores above 6.5.
The two isolation bugs deserve the closer read. CVE-2026-105752 defeats salted prefix caching: a Harmony tool continuation posted to /v1/responses is rebuilt without its cache_salt, dropping the continuation prefix into the global unsalted namespace, so an authenticated tenant who can reconstruct a victim's low-entropy post-tool history can watch cached_tokens_per_turn to learn whether that prefix was processed. CVE-2026-105755 is blunter — /score and /rerank derive each worker's query key from the caller-supplied X-Request-Id, so a concurrent request reusing a victim's identifier overwrites the cached query embedding and the victim's documents get scored against the attacker's query. vLLM 0.31.0 shipped the same day and anything from 0.30.0 onward covers the batch; 0.31.0 separately stops accepting per-request multimodal kwargs, including mm_processor_kwargs and media_io_kwargs, unless the server is started with --trust-request-mm-kwargs. Then came the tenth. At 06:17 UTC on 6 October NVD published CVE-2026-105775, a remotely reachable out-of-bounds read in conv_ssm_forward in the Mamba mixer, affecting vLLM "up to 0.31.0", with the exploit public and the record noting the project was informed through an issue report and has not responded. It scores 2.1 on CVSS 4.0 (4.3 on CVSS 3.1), so it is a nuisance rather than an emergency — but it is the one item on the list that upgrading does not clear.
A 501B model called open weights, with no weights out and no outside scores
Reflection AI announced Beam on 5 October: 501 billion total parameters with 23 billion active, trained on 23.8 trillion tokens across a cluster of 6,144 Nvidia GB300 NVL72 GPUs and then given four weeks of reinforcement learning on roughly 10,500 GB300s, a one-million-token context, and an Apache 2.0 licence. The weights are not out. The lab says weights, technical report and model card follow "later this month"; for now there is a waitlist for API access. The Nvidia-backed company has held talks to raise $2.5bn at a $25bn valuation, per Wall Street Journal reporting relayed by Bloomberg.
Every number published so far is Reflection's own. Its table puts Beam at 80.1 on Terminal Bench v2.1, 80.9 on SWEBench Verified and 44.4 on DeepSWE v1.1, and the headline claim is that on advanced reasoning benchmarks it scores comparably to GLM-5.2 "while using 3–4× less inference compute". Against figures Help Net Security sourced to Artificial Analysis and DataCurve, Kimi K3 scores 88.3 and DeepSeek V4.1 Flash 90.6 on the same Terminal Bench version, and on DeepSWE v1.1 Beam's 44.4 sits 0.4 points above GLM-5.2 and 29.8 points behind DeepSeek V4.1 Flash. The compute claim is the genuinely interesting one and the hardest to audit, because it rests on Reflection's own approximation — twice the active parameter count times the average number of tokens generated — which Help Net Security notes leaves out prompt processing, attention costs and serving overhead. For a European team the practical position is short — nothing to download, nothing to self-host, and no third-party measurement yet.
Seven flaws in two agent-building platforms, and five of them are in the MCP plumbing
The same disclosure window carried five CVEs against Langflow and two against Dify. Two of the Langflow entries score 9.9. CVE-2026-105740 (fixed in 1.9.0) and CVE-2026-105697 (fixed in 1.10.3) are the same shape: an MCP server added with the stdio transport passes its user-supplied command straight to bash -c "exec {command}" with no allowlist and no sandbox, and it runs on the Langflow host as the Langflow process user the moment the server list is fetched — before 1.10.3, even when the interface then reports that the stdio server failed to start. The record for CVE-2026-105697 adds the line that matters for anyone who put Langflow on a network: with the default LANGFLOW_AUTO_LOGIN=true, GET /api/v1/auto_login hands out a token with no credentials, so on an exposed default install there is no account to compromise first.
The rest are tenant boundaries. CVE-2026-105699 (fixed in 1.9.1) let a user on any project-scoped MCP endpoint call resources/read for another tenant's flow-backed file — uploaded documents, structured data, prompts. CVE-2026-105741 (fixed in 1.10.3) accepted a spoofed X-Forwarded-For: 127.0.0.1 header to get past a local-only check and write an MCP client configuration file onto the server. CVE-2026-105698 (fixed in 1.10.1) let a caller who knew another user's flow UUID execute selected vertices and read the results. On Dify, CVE-2026-105761 (fixed in 1.16.0) let an authenticated workspace member alter another application's MCP server settings, and CVE-2026-105762, an 8.3 published early on 6 October and fixed in 1.13.0, is an unauthenticated SSRF at /console/api/remote-files/upload that fetches whatever URL it is given, cloud metadata endpoints included. Five of the seven sit in MCP handling.
Quick Hits
- Altman-backed Volantis raised $88m to move memory centimetres away from the die. The Register reports the San Francisco startup is integrating micro-VCSELs into the interposer, and believes it can put upwards of 10 TB of memory at speeds up to 240 TB/s on a single package. CEO Tapa Ghosh says "aggressively, we should aim for an MVP product in 12 to 18 months as our target" — a prototype, not volume production.
- A preprint says prompt-injection detectors do not survive a change of benchmark. The 2 October paper runs fifteen detectors, including Meta's Prompt Guard 2, across BIPIA, AgentDojo and tau-bench: the best BIPIA detector caught 2% of AgentDojo injections at a 1% false-positive rate, and one scoring 72% on AgentDojo fell to 15% on tau-bench. Single-author and not peer reviewed, but the procurement question it implies is fair — which benchmark produced your vendor's number.
- Memory going to AI datacentres is now visible in what everything else costs. Rest of World reports that Samsung, SK Hynix and Micron hold over 90% of the memory market and all three shifted supply toward AI datacentres in late 2025, with sub-$100 smartphone shipments down almost 60% year on year in Q2 2026. Counterpoint's Ivan Lam and IDC's Ramon Llamas both expect the squeeze to persist.
- A French startup raised €4m for offensive security tooling built on AI. Fleuret AI announced the pre-seed round on 5 October, per Tech.eu.
- Zurich's Namespace raised a $42m Series B seven months after its Series A. The developer-infrastructure company's round is also reported by Tech.eu; build and CI capacity is where a lot of agent workloads quietly land.