Wonder Full scores 56 and cannot be bought by the token
Meta Superintelligence Labs released Muse Wonder and Muse Wonder Full on 12 October. Meta's own post calls them "the next step on our scaling ladder and a major leap toward personal superintelligence", and says Wonder is available through the Meta Model API and Muse Code while Wonder Full is available to Muse Code subscribers only (research.meta.ai). Wonder lists at $4 per million input tokens and $20 per million output, with cached input at $0.20. Wonder Full has no pay-as-you-go API price at all, reachable only through the $50-a-month Power Usage and $200-a-month Maximum Usage tiers (VentureBeat). Neither ships weights, which is the opposite of what Meta did with the 30B Muse Glimmer in August. TechCrunch calls this the company's first attempt at a frontier model and says both were trained at Meta's Prometheus site in central Ohio.
The capability numbers are good and the cost numbers are not. Artificial Analysis puts Wonder Full at 56 on its Intelligence Index and Wonder at 52, against Claude Opus 5.5 at 58 and GPT-6 Astra at 53. But the index run cost $4.52 per task on Wonder against $5.98 on Opus 5.5 and $3.26 on GPT-6 Astra, and Wonder emitted 130M output tokens across the run where the median for comparable models is 85M. Wonder Full emitted 140M against an 88M median, and Artificial Analysis lists no cost per task for it because it has no public rate to compute one from. Two procurement details from VentureBeat's reading of Meta's zero-data-retention and Contributor-mode terms matter more than any benchmark row: zero data retention is open to qualified Model API organisations subject to approval, but it does not support server-side conversation state, background requests, file uploads or built-in web search; and Muse Code subscriptions default to a Contributor mode in which Meta may train on submitted content, with opt-out applying only to future submissions.
Twenty-one CVEs for one nginx web UI in four days, and the MCP tools are the repeat offender
NVD published eleven Nginx UI records on 12 October — ten at 21:17 UTC and CVE-2026-84312 an hour later — on top of ten published on 9 October, making 21 CVE IDs for one project inside four days. Four of the eleven are the same shape: the MCP interface skips a security control the REST API enforces. CVE-2026-84318 (8.8) says the MCP tool nginx_config_add writes configuration to disk and reloads nginx without calling config.ValidateConfigFile, while the identical flow at POST /api/configs does call it and rejects blocked directives — so an authenticated caller can write perl, js_import, load_module or user root and, on a server with the Perl, njs or Lua module loaded, get post-authentication remote code execution. CVE-2026-84319 (8.3) covers a secondary authenticated user loading ngx_http_js_module.so and running NJS in the worker context by the same route, and CVE-2026-84360 (8.1) notes that /mcp and /mcp_message require only ordinary authentication where the HTTP mutation routes require RequireSecureSession, so an OTP-enabled user holding a plain JWT skips the step-up entirely. Every score here is GitHub's own, filed as a secondary metric; NVD has published no assessment of its own for any of the 21.
The dates are the other half, and they are worse than the scores. All eleven of the 12 October records trace to repository advisories the project published on 17 July 2026, and eight of the 9 October batch to advisories published on 12 August — so anyone watching a CVE feed rather than the repository had no signal for up to three months on flaws the maintainers had already written up. The CVE records say "fixed in 2.4.1" (2.4.3 for one), while the repository advisories for the same issues list no patched version and give ranges as loose as "2.x dev branch". Nor is 2.4.1 the end of it: an advisory published 30 September, GHSA-x2x3-p8j2-63mx, describes an MCP parser differential that lets read-scoped tokens invoke write tools in 2.4.1 through 2.6.1, fixed in 2.6.2 — and it still has no CVE ID, as do two criticals from the August batch, one of them titled an incomplete fix for the unauthenticated restore RCE the project disclosed on 27 April as CVE-2026-42238. Two records published the same day show this is not one project's habit: CVE-2026-108953 (8.5 on CVSS 4.0) says mac-shell-mcp before 2.0.0 let a whitelisted command such as pwd carry shell metacharacters in its arguments and run forbidden ones without approval, and CVE-2026-77366 (9.9 on CVSS 3.1) says obsidian-tc before 1.3.1 issued JWTs with no vault claim, so any valid token could select another configured vault and read, write or delete it. Bolt an MCP server onto a product that already has an authorisation layer and the checks do not come with it.
GitLab's critical patch carries two agent flaws, and the 19.3 line needed cutting twice
GitLab's latest critical patch fixes 24 vulnerabilities, headed by CVE-2026-97229 at 10.0, which GitLab titles an integer overflow in the CI/CD regular-expression compiler. Two of the 24 sit in the Duo Agent Platform and both were found by GitLab's own staff. CVE-2026-96893 (7.3, Enterprise Edition) says an authenticated user could inject crafted content into AI agent instructions, "potentially causing unintended command execution attributed to other users", reported internally by Mert Coskuner. CVE-2026-105458 (4.3, EE) says a user holding a specific granular permission could obtain a Duo Agent Platform token that bypasses governance controls, reported internally by Rahul Barnwal. Both records were published to NVD within seconds of each other at 02:16–02:17 UTC today. GitLab.com already runs the patched version and Dedicated customers need no action; the work is on self-managed installations.
The release itself needed two attempts on one branch. GitLab's advisory says "On October 12, 2026, we released versions 19.4.2, 19.3.5, 19.2.8" and adds that "19.3.4 had a bug that affected merge request pages when the Ona integration was enabled. This is fixed in 19.3.5" — so the 19.3 line needed a second cut, and 19.3.5 is the number that appears throughout the advisory and in GitLab’s own CVE records, which give the fixed range as "19.3 before 19.3.5". For an EU buyer the phrase worth reading twice is "bypasses governance controls": the platform bought to supervise coding agents is itself an authorisation surface, and a permission model that hands out a platform token is a compliance finding before it is a bug.
Quick Hits
- OpenAI's EU text watermark is announced, not yet everywhere, and its own numbers show how little survives editing — The 5 October announcement says an invisible statistical signal called textGrain will reach ChatGPT and Codex output in the EU "over the coming weeks"; what went live the same day is an API opt-in for developers worldwide, off by default, with the detector available only to approved researchers and expert organisations. OpenAI's published figures, measured on ELI5 psychology responses at a 1% false-positive rate: about 80% detection on a 200-token passage and 95% at 400 tokens, and on 400-token passages, replacing 10% of the words with synonyms drops detection from about 92% to 66%, with 25% replacement leaving 17% (BleepingComputer, TechCrunch).
- A dict wrapper got past Crawl4AI's config gate and came back with the signing key — CVE-2026-109237 (8.6 on CVSS 4.0, 8.1 on 3.1, both VulnCheck's, published 12 October) says Crawl4AI from 0.9.0 before 0.9.4 let non-admin API clients build forbidden config objects by wrapping them in dict-type wrappers, then send a laundered LLMConfig with an env-reference api_token to /config/dump to read SECRET_KEY and provider keys — enough to forge an admin JWT.
- Open WebUI's September cookie fix now has a CVE and a number — CVE-2026-109292 (7.6 on CVSS 4.0, 6.8 on 3.1) covers 0.6.27 before 0.11.4 forwarding the full browser cookie jar on OAuth-mode connections, so operators of OpenAI-compatible connections, OpenAPI tool servers or terminal servers could capture session cookies from routine requests and replay them, administrators included. The release that fixed it shipped on 21 September and made cookie forwarding opt-in, which an instance that relied on it has to switch back on after upgrading. A companion record, CVE-2026-109296 (5.3 on 4.0), lets an authenticated user reach disabled provider backends by passing an explicit backend index.
- A medical-imaging inference runner unpickles a path it reads out of a JSON file — CVE-2026-109361 (7.3 on CVSS 3.1, 7.0 on 4.0, published 12 October) says MONAI 1.2.0 before 1.6.1 has nnUNetV2Runner unpickle the postprocessing_file path taken from inference_information.json without confining it to the results directory, so anyone able to edit that file gets code execution when predict_ensemble_postprocessing runs.