Top Tweets for #GPUStack
What if an attacker could take over your AI infrastructure without a password or stolen credentials?
CVE-2026-102895 exploits GPUStack’s trust in localhost requests, enabling unauthenticated admin access.
Full breakdown - https://t.co/U8NksXI2SP
#Cybersecurity #GPUStack
CISA KEV: GPUStack Bypass (CVE-2026-102895)
• CVSS 9.8 127.0.0.1 auto-admin spoof
• Hijacks AI GPU workers & API keys
• Upgrade to GPUStack 2.2.0+ now
Read full Blog: https://t.co/m4y3zaBPL6
#sh3llc0d3 #shellcode #AISecurity #GPUStack #CISA
CVE-2026-102895: GPUStack trusts 'localhost' as admin — and you can forge it with a header. Unauth → RCE on your AI servers. CVSS 9.8, exploited, patch to 2.2.0. @ksg93rd #cybersecurity #cve #gpustack https://t.co/0YHNKbej9a
🔐 Team kit: https://t.co/mRtKMuqkMZ
#NØØT_Security_Alerts
#GPUStack #ConfirmedExploitation — CVE-2026-102895 | Loopback/reverse-proxy trust bypass grants unauthenticated admin access; the project advisory reports an exploited v2.1.1 deployment.
AFFECTED: below 2.2.0.
FIXED: 2.2.0. Audit API keys and custom backends; investigate possible worker execution.
SOURCE: https://t.co/SQbqZKzdFV
#CyberSecurity #CVE #CloudSecurity #IncidentResponse
Attackers exploit the GPUStack authentication bypass CVE-2026-102895 in the wild. Update to 2.2.2 now to fix this flaw and CVE-2026-102894.
#GPUStack #AISecurity #Cybersecurity #Vulnerability #InfoSec
https://t.co/Nt64zv8VLh
⚠️ GPUStack CVE-2026-102895: default force_auth_localhost=false; same-host reverse proxy or forged X-GPUStack-Real-IP grants unauth admin (RCE, secret theft). Affects <2.2.0; fix 2.2.0. CVSS 3.1:9.8. Exploited in the wild. KEV due 11-12.
https://t.co/eZLz9LvmII
#GPUStack
⚠️ OpenSSH CVE-2026-123158: password-auth bypass on Linux+musl, PAM off (<10.6p2). Needs PasswordAuthentication yes, *-password account, $5$/$6$ hash. CVSS 3.1:8.1 (AC:H). Public PoC. Newly added to CISA KEV (due 11-12).
https://t.co/emnFHUwGG8
https://t.co/BIs36Ty36V
#OpenSSH
⚠️ FreeSWITCH CVE-2026-116779: inbound SIP MESSAGE can run API/system commands (≤1.11.2; fix ≥1.11.3). Needs MESSAGE (default on); if auth on (1.10.7+ default), any registered account works. CVSS 3.1:9.8. Exploited in the wild. KEV due 11-12.
https://t.co/tFVHIqMJPQ
#FreeSWITCH
⚠️ IBM Aspera Faspex CVE-2026-123218: authenticated user can craft a message to bypass authorization and gain full admin. Affects 5.0.0–5.0.19; fix 5.0.19 PL1. CVSS 3.1:9.8 (PR:N vs auth). Newly added to CISA KEV (due 11-12).
https://t.co/7Qz7o0K0mt
#Aspera #IBM
🚨 SAP NetWeaver AS ABAP (ICM) CVE-2026-76964: unauthenticated memory corruption can lead to arbitrary code execution and full compromise. CVSS 3.1:10.0. Disclosed in today's SAP Security Patch Day.
https://t.co/XWTONmzSa5
#SAP #NetWeaver
🚨 SAP Gateway CVE-2026-89103: overly permissive default ACL lets an unauthenticated attacker be treated as an internal application server. CVSS 3.1:10.0. Disclosed in today's SAP Security Patch Day.
https://t.co/xNzksW9T9y
#SAP #Gateway
🚨 SAP Web Dispatcher CVE-2026-89126: unauthenticated memory corruption can lead to arbitrary code execution and full compromise. CVSS 3.1:10.0. Disclosed in today's SAP Security Patch Day.
https://t.co/1INBkmlDz5
#SAP
🚨 SAP NetWeaver AS ABAP (SAML2 SP) CVE-2026-120017: under certain configurations, insufficient assertion checks let an unauthenticated attacker impersonate any user, incl. privileged accounts. CVSS 3.1:10.0. Today's SAP Security Patch Day.
https://t.co/bQWxpL2JE6
#SAP #NetWeaver
🚨 SAP S4CRM/S4CEXT/BBPCRM CVE-2026-109795: missing authorization and weak input checks let a low-privilege attacker inject and execute arbitrary code. CVSS 3.1:9.9. Disclosed in today's SAP Security Patch Day.
https://t.co/I9uVKa8thA
#SAP
🚨 SAP NetWeaver Knowledge Management CVE-2026-109803: insufficient XSLT restrictions in XML Forms may, under certain conditions, let an authenticated user get arbitrary code execution. CVSS 3.1:9.9. Today's SAP Security Patch Day.
https://t.co/3sjSIBZBit
#SAP #NetWeaver
🚨 SAP NetWeaver AS ABAP CVE-2026-76965: a missing authorization check on an internal function lets a low-privilege attacker run OS commands on the host. CVSS 3.1:9.9. Disclosed in today's SAP Security Patch Day.
https://t.co/VlFf580xPq
#SAP #NetWeaver
🚨 SAP Web Dispatcher / ICM CVE-2026-89119: CSRF in an admin function can let an unauthenticated attacker trick a logged-in admin into fully compromising the OS. CVSS 3.1:9.6. Disclosed in today's SAP Security Patch Day.
https://t.co/N5vQyIfXzf
#SAP
🚨 SAP BusinessObjects BI CVE-2026-109798: XXE in Web Intelligence OLAP connections lets an authenticated attacker read sensitive server files. CVSS 3.1:9.1. Disclosed in today's SAP Security Patch Day.
https://t.co/hh7vqGCkKG
#SAP #BusinessObjects
🚨 Versa VOS CVE-2026-107240: if ZTP Node.js is still enabled, unauth /authenticate command injection can run shell commands. Affects 21.1.1–21.2.3; 22.1.2–22.1.4 <July-2-2026 HF; 23.1.2 <Aug-3-2026 HF. CVSS 3.0:7.6 (AC:H/PR:H/UI:R vs unauth).
https://t.co/ZMaA5pBnTF
#Versa #VOS
🚨 Versa VOS CVE-2026-107244: if ZTP Node.js still enabled, unauth /decryptTest (hardcoded key, pre-auth) can forge a session. Affects 21.1.1–21.2.3; 22.1.2–22.1.4 <July-2-2026 HF; 23.1.2 <Aug-3-2026 HF. CVSS 3.0:7.6 (AC:H/PR:H/UI:R vs unauth).
https://t.co/ySmIbvkBHD
#Versa #VOS
🚨 Plesk Site Import CVE-2026-107246: a path traversal in <1.13.2 lets a non-owner subscription user redirect a privileged session and get root code execution. CVSS 4.0:9.2 (AT:P; PR:N vs subscription user).
https://t.co/VmhN34Egym
#Plesk
A critical authentication bypass in GPUStack, the open-source GPU cluster manager used to serve AI models at scale, was exploited in the wild before a patch arrived — allowing unauthenticated... https://t.co/ZByKa21GWt
#Gpustack #AuthBypass #ActivelyExploited #CVE #InfoSec
🚀 GPUStack v2.3 preview is here!
Try v2.3.0rc2: vGPU (K8s only), automatic PD disaggregation, cross-replica KV cache sharing & more.
😍What are you most excited to try? Share your feedback!
⚠️ Use a fresh environment. Upgrades aren't supported.
#GPUStack #AI #OpenSource
Deploying DeepSeek-V4.1-Flash on Day 0 🚀
GPUStack × vLLM benchmarks across H20, H200, and H100—covering deployment setup and performance, all in one place.
🔗 Get started with GPUStack: https://t.co/mpjRx0hVxb
#GPUStack #DeepSeek #vLLM #LLMDeployment #AIInfrastructure
Congrats on the release! @thinkymachines
Exciting to see Inkling pushing open multimodal models forward.
We just ran Inkling-BF16 on GPUStack with 8× H20-141G — great to see it working in a real-world deployment. #Inkling #GPUStack #AIInfra #OpenSourceAI #MultimodalAI #LLM
Today, we are introducing Inkling.
Inkling reasons efficiently across text, image, and audio modalities. We are making the full weights available.
https://t.co/Ghebq5mG30
Available today for fine-tuning on Tinker. Play with it in the Inkling Playground. 🧵
$ sudo su ops
⛓️ | Sudo Su Bot is online
⚡ | Nexus syncing
🧠 | Raven coin stacking
🎧 | Terminal talk active
>> Animated ops report loading...
#SudoSuOps #AIgrind #GPUstack
Trends for you
Most Popular Users
Elon Musk 
@elonmusk
240.9M followers
Barack Obama
@barackobama
118.7M followers
Cristiano Ronaldo
@cristiano
114.5M followers
Donald J. Trump
@realdonaldtrump
111.9M followers
Narendra Modi
@narendramodi
107M followers
Rihanna
@rihanna
98.7M followers
NASA
@nasa
92.2M followers
Justin Bieber
@justinbieber
91.8M followers
KATY PERRY
@katyperry
90M followers
Taylor Swift
@taylorswift13
84M followers
Lady Gaga
@ladygaga
75.5M followers
Virat Kohli
@imvkohli
73.4M followers
Kim Kardashian
@kimkardashian
70.8M followers
YouTube
@youtube
68.7M followers
Neymar Jr
@neymarjr
66.4M followers
Bill Gates
@billgates
65.2M followers
Selena Gomez
@selenagomez
63.1M followers
The Ellen Show
@theellenshow
62.2M followers
CNN
@cnn
61.7M followers
X
@x
60.6M followers