Sandipan Roy

Senior Product Security Engineer @RedHat | SDE @Fedora | #PSIRT #RHEL | Ex @parrotsec

[Sandipan Roy @ByteHackr]

Learn how RHEL 9 simplifies system-wide crypto policies for stronger security and compliance. Customize policies to meet your needs!

Ref: https://t.co/LTMK4PQkTR

@rhdevelopers @RedHatSecurity @RedHat
#CyberSecurity #Linux #RHEL #CryptoPolicies #Compliance #Infosec #RedHat

[Sandipan Roy @ByteHackr]

Hey @INDmoneyApp , my outbound RSU/stock transfer is stuck and the app chatbot is looping. Standard support is completely unresponsive. Please get a human customer agent to look into Ticket ID: 3538456 immediately. @ashishkashyap #INDmoney @AlpacaHQ #RSU

[Google VRP (Google Bug Hunters) @GoogleVRP]

Introducing PageBreak, an agentic vulnerability discovery tool using deterministic validation to achieve a near-zero false positive rate.

How it works: https://t.co/n3k4vvNhoq

For real-world vulnerabilities PageBreak has discovered 👇

https://t.co/0pZ5rWoWw2

[Sandhya @agenticgirl]

Alibaba open-sourced the code reviewer it says has served tens of thousands of developers and found millions of defects internally. Open Code Review does not leave the whole review loop to an LLM: deterministic code handles file coverage, bundling, rule matching and comment positioning, while the agent handles reasoning and repository context. On its benchmark of 200 PRs across 50 open-source repos, Alibaba reports higher precision and F1 than Claude Code with the same model, using roughly 1/9 the tokens, with lower recall as the trade-off. GitHub Repo: https://t.co/vSXeaq0DzQ

[Ryan Wright @IQReactorAI]

A 7-person team just took 3 small open-source models to #1 in cybersecurity at their size classes.

They used Qwen3.8-27B, Qwen3.6-35B-A3B, and Qwen3.5-122B-A10B. All three ranked #1 among open models at comparable sizes.

TL:DR:

First they let agents work through controlled exploit / cyber environments, verified the results, then fine-tuned on that data.

Here is what they did:

They built coding, vulnerability, CTF, Linux-kernel-history, full-exploit, firmware, and device-backed environments.

Kept what worked: models learned from runs that passed execution verification / auditing.

Using pure fine-tuning (no RL), their three models improved an average of +23.76% on the full CyberGym suite. Feyospace-s1 hit 63.24% verified success and #10 on CyberGym

Paper: https://t.co/MJ8Bcm6arW

[Md Ismail Šojal 🕷️ @0x0SojalSec]

The 14B Rust specialist Open-model run locally.

- Strand-Rust-Coder-14B is fine-tuned specifically for Rust ownership, - lifetimes, concurrency, clean refactors
- and production-ready strong compile-ready code.

- https://t.co/FsXd07GRDf

[Zakir Hossain | AI & Tech @zakiraicoder]

50 websites that feel like the internet’s hidden toolbox 🧰

1. https://t.co/IF0e93Vsik — Free research papers
2. https://t.co/hJt2YM0nzp — Borrow books online
3. https://t.co/VEPPx9b4Jw — Free academic journals
4. https://t.co/BdlNvpK4nQ — App alternatives
5. https://t.co/XyhBiTbzTH — Find where to stream
6. https://t.co/KDjOuBVmft — Internet archives
7. https://t.co/9Y8pcXCzKu — 70K+ free books
8. https://t.co/wYZrW6O9C0 — Free textbooks
9. https://t.co/Bobq0w1hyR — Free courses
10. https://t.co/evZc7gnIRO — Solve complex problems
11. https://t.co/siSTGmfU8y — Photoshop alternative
12. https://t.co/HpcKqPbpyZ — Compress images
13. https://t.co/viSOVfImJd — Remove backgrounds
14. https://t.co/YzQ27OlQ2m — Remove objects
15. https://t.co/eebiOp0kCd — Remove video backgrounds
16. https://t.co/spsEfKcCzi — Beautiful code images
17. https://t.co/r8rxbML0O9 — Code screenshots
18. https://t.co/xXhy4Iacmd — Product mockups
19. https://t.co/YlRUmjvxuI — Create mockups
20. https://t.co/HUfTXu5MjB — Check data breaches
21. https://t.co/J5nf7cVzgN — Scan files & URLs
22. https://t.co/JwqMSHZ311 — Self-destructing notes
23. https://t.co/zSKCYd0ViU — Temporary email
24. https://t.co/ekKTp2Uksd — Temporary file sharing
25. https://t.co/5HALmVhiN0 — Save webpages
26. https://t.co/1LgssfQ1z7 — Find similar websites
27. https://t.co/7JjneNRlN5 — Explore global radio
28. https://t.co/I3bd7ERxxl — Discover music genres
29. https://t.co/dLZYENDpkU — Find songs from shows
30. https://t.co/pBcnacpBD8 — Focus music
31. https://t.co/sMHB2bOHEq — Custom background sounds
32. https://t.co/UHoFN2OLIw — Café ambience
33. https://t.co/9Q3muzXKRO — Research assistant
34. https://t.co/UNJRIStN25 — Research-backed answers
35. https://t.co/yS5IABTRNh — Research connections
36. https://t.co/6ZduOfAU1p — Academic search
37. https://t.co/e0pHZRAc7r — Understand research papers
38. https://t.co/oGs5Rw3OnH — YouTube summaries
39. https://t.co/a4gnOX6DPv — AI for developers
40. https://t.co/DWO81MQyqe — Test regex
41. https://t.co/3b1OAJQlrn — Format code
42. https://t.co/DhBWOvxNYH — Format JSON
43. https://t.co/9v0uL8DCzG — Understand terminal commands
44. https://t.co/dRO90EfwYJ — Bookmark manager
45. https://t.co/MSjW4Fe1JF — Check outages
46. https://t.co/pdSYz9s99p — Reverse image search
47. https://t.co/mOEq7HaMX8 — Internet speed test
48. https://t.co/U9L4qe5fIY — PDF tools
49. https://t.co/q35tv4QVSL — Merge/split PDFs
50. https://t.co/tHSNS9bUnh — Temporary email

Save this. You’ll definitely need some of these later. 🔖

Follow @zakiraicoder for more useful websites, AI tools & tech resources.

[Sandipan Roy @ByteHackr]

@MatthewBerman @bot Yhooo

[Sandipan Roy @ByteHackr]

Found a vulnerability in RPM "rpmbuild" tarball processing: a crafted ".spec" member name can inject RPM macros, including Lua expressions, leading to arbitrary code execution.

CVE-2026-78367

GitHub: https://t.co/eW6dH2bJBH
CVE: https://t.co/N1WlRwA3d2

#CVE #RPM #Linux #RedHat

[Red Hat Open @redhatopen]

AI built via #opensource is AI built to last. Projects like llm-d demonstrate that the most resilient infrastructure isn't owned by a single company—it's strengthened by a community.

Read why we believe AI infrastructure must be built in the open: https://t.co/XGlUbK6zIz

[Ahmad @TheAhmadOsman]

ATTENTION

The bible for running LLMs locally is now available online to read for FREE

Covers what to use on

- Laptop / edge / odd hardware
- Mac-first workflows
- Single RTX GPUs
- 2-4+ NVIDIA / CUDA GPUs
- General production serving
- Long-context / MoE / routing
- NVIDIA max performance
- Cluster orchestration

Software

- llama.cpp
- MLX / MLX-LM
- ExLlamaV2
- ExLlamaV3
- vLLM
- SGLang
- TensorRT-LLM
- NVIDIA Dynamo

You should read this, and if you cannot now then you most definitely wanna bookmark it for later

Local & Opensource AI FTW

[Sebastian Raschka @rasbt]

The Kimi K3 architecture figure for yesterday's big open-weight model release, along with some observations and thoughts.

1. Yes, it looks relatively complicated, but it's essentially a scaled-up production version of their Kimi Linear model they released last year (scaled up from 48B -> 2.8T; K3 is by far the biggest open-weight model right now)

2. The one new component compared to Kimi Linear is the LatentMoE. I omitted it in the figure below since it's already very crowded, but that's essentially the same LatentMoE as in Nemotron 3 Ultra (you can find it in my LLM Architecture Gallery if you are curious). The idea here is to compress (down-project) large linear layers similar to multi-head latent attention.

3. Kimi K3's overall trend (similar to Nemotron 3, DeepSeek V4, and others) is also towards better inference efficiency. That is, there are many components that replace existing components with efficiency-tweaked versions. I.e., MoE -> LatentMoE, regular attention -> multi-head latent attention and Kimi Delta Attention. (I also have short tutorials and write-ups in my gallery if you are curious about additional details).

4. The one component change that is not an efficiency tweak is attention residuals. Like DeepSeek V4 improved the residual path with mHC (manifold-constrained Hyper-Connections), attention residuals are a way to improve the residual path, but it works a bit differently. I.e., mHC made the residual path wider. Attention residuals (also already part of Kimi Linear) connect the residuals across layers; the connection itself uses an attention score for an important/contribution weight. According to the report, it improves the validation loss and downstream performance (a bit) consistently and adds about 4% in training cost and 2% in inference cost.

5. Interestingly, Kimi K3 got rid of all RoPE layers and uses NoPE (No Positional Embeddings) everywhere instead. (Again, this is inherited from Kimi Linear). In other architectures, the recent trend was towards RoPE in local attention layers (like sliding window attention) and NoPE in the global layers. There were a few architectures that only used NoPE everywhere, but this is the first frontier-level one as far as I know.

6. Kimi K3 now also has native multimodal support, which is great!

There are several other interesting training tidbits in the technical report, but that's it from the architecture front so far. A really great release overall.

[ali @waterloo_intern]

https://t.co/aivc7B4A7Z

[Kimi.ai @Kimi_Moonshot]

Releasing the model weights and technical report of Kimi K3.

Kimi K3 is our most capable model: a 2.8T MoE model with native visual understanding and a 1M-token context window.

New model architecture: 2.5x the intelligence per unit of compute, not just more params.

Alongside Kimi K3, we're opening up more of the stack behind it — high-performance attention kernels, MoE communication library, and infrastructure for running agent environments at scale.

Model weights: https://t.co/7m7eEg6Y0B
Tech report: https://t.co/yeu6cjpMCT
Tech blog: https://t.co/YTfiMSNM1f

[Zhihu Frontier @ZhihuFrontier]

🧩 Kimi K3’s Architecture Is Here—and KDA + AttenRes Arrive Together
Zhihu contributor kaiyuan reconstructed an early Kimi K3 architecture diagram from the information currently available, using K2.5 as the baseline.
The architecture is now public, although the model weights have yet to be released. One detail already stands out: KDA and AttenRes appear together in K3’s design.

🔍 A prediction that landed
When Kimi K2.6 was released, kaiyuan predicted that KDA and AttenRes might arrive as a pair. K3’s architecture has now confirmed that intuition.
👉Check it out：
https://t.co/Mm3wJefzMo

🛠 An evolving architecture map
This is an initial, manually assembled draft intended to make K3’s structure easier to inspect. The diagram will be updated once the official weights become available.
📊High-resolution diagram:
https://t.co/A93fIoDhVs

🔗 Full Reading:
https://t.co/uA35hqErLN

#KimiK3 #Kimi #MoonshotAI #LLM #AIInfrastructure #ModelArchitecture

[Sandipan Roy @ByteHackr]

@Cloudflare @airtelindia @Airtel_Presence

[Sandipan Roy @ByteHackr]

Unfortunately, my Internet provider (AS24560) does NOT implement BGP safely. Check out https://t.co/nffJc4CvoY to see if your ISP implements BGP in a safe way or if it leaves the Internet vulnerable to malicious route hijacks. via @Cloudflare

[It's FOSS @Itsfoss]

Quantum computers will one day break the encryption protecting your messages. Apple is preparing for that now and they just made their work public.

Apple has open-sourced the post-quantum cryptography code from corecrypto, the encryption library running on over 2.5 billion Apple devices. It protects iMessage, VPNs, and HTTPS connections.

Here is why this matters.

Most encryption used today relies on math problems that regular computers find nearly impossible to solve. Quantum computers can solve those same problems with ease. They do not exist yet at the scale needed, but the threat is considered real enough that governments and major tech companies are already preparing.

The solution is post-quantum cryptography, a new generation of algorithms designed to resist quantum attacks. Apple has picked two of the NIST-standardised ones: ML-KEM and ML-DSA.

By open-sourcing the code and the mathematical proofs behind it, Apple is letting independent experts verify that there are no hidden flaws. This is a big deal because a single bug in corecrypto could compromise the security of every app and feature running on 2.5 billion devices.

And independent review already proved its value here. During formal verification, researchers found a flaw in an early implementation that standard testing would have missed entirely.

This is how security should work. Build it in public, let others verify it, fix what gets found.

Apple does not always get credit for open-source contributions. This one deserves it.

[V4bel @v4bel]

💥 Introducing "Dirty Frag"

A universal Linux LPE chaining two vulns in xfrm-ESP and RxRPC. A successor class to Dirty Pipe & Copy Fail.

No race, no panic on failure, fully deterministic. ~9 years latent.
Ubuntu / RHEL / Fedora / openSUSE / CentOS / AlmaLinux, and more.

Even if you've applied the "Copy Fail" mitigation, your Linux is still vulnerable to "Dirty Frag". Apply the Dirty Frag mitigation.

Details:
https://t.co/9nqku4svkY

[DeepSeek @deepseek_ai]

🚀 DeepSeek-V4 Preview is officially live & open-sourced! Welcome to the era of cost-effective 1M context length.

🔹 DeepSeek-V4-Pro: 1.6T total / 49B active params. Performance rivaling the world's top closed-source models.
🔹 DeepSeek-V4-Flash: 284B total / 13B active params. Your fast, efficient, and economical choice.

Try it now at https://t.co/GCdiMzk1Dl via Expert Mode / Instant Mode. API is updated & available today!

📄 Tech Report: https://t.co/drlDrxkYtp
🤗 Open Weights: https://t.co/T13Y8i7SDM

1/n

[0xor0ne @0xor0ne]

Reverse engineer and get full root access on the TP-Link Tapo C200 (2025)

https://t.co/bZs0gVGO5L

Research by @qkaiser

#infosec