Stéphane Karges

[axiaisacat @axiaisacat]

4GB 显卡跑 70B 大模型，听起来像标题党。

但 AirLLM 这个 21.4k Star 项目，README 第一屏就写得很直：

70B 模型，单张 4GB GPU 推理。

Llama 3.1 405B，8GB VRAM 也能跑。

它不是把模型砍小。

也不是靠蒸馏、剪枝糊弄过去。

核心思路是把推理时的内存占用压下来：
模型按层拆开，需要哪层加载哪层，再配合预取和压缩，把“显存不够”这件事往后推。

这对本地大模型玩家很要命。

因为过去很多所谓“本地部署”，真正的门槛不是会不会写代码，而是你有没有足够贵的显卡。

[bearstech @bearstech]

🏖️🐻 Les Logiciels Libres de l'été, jour 5

Pangolin : une solution Open Source de reverse proxy intelligent conçue pour exposer et sécuriser vos applications.

[Daily CyberSecurity @the_yellow_fall]

Discover critical Gitea security flaws exposing servers to account takeovers and SSRF attacks. Read about CVE-2026-20896 and CVE-2026-22874 patches today.

#Gitea #Cybersecurity #CVE202620896 #CVE202622874 #Vulnerability
https://t.co/nCAKq1ZLGW

[9to5Linux @9to5linux]

Ventoy 1.1.16 is out now to fix a boot issue with old UEFI version firmware when Secure Boot is disabled, the latest Kicksecure boot issue, and an issue causing the VTOY_WIN_UEFI_RES_LOCK option to reset when entering VentoyPlugson https://t.co/0Xp9tS2qX3

#OpenSource #Linux

[Cyber Security News @The_Cyber_News]

25-Year-Old Vulnerability in cURL Used by 30 Billion Devices Finally Patched

Source: https://t.co/U1eqeAcK9G

A critical security flaw lurking in curl for over 25 years has been patched, as part of a record-breaking security release that fixed 18 CVEs, the most ever issued in a single curl version.

The vulnerability, CVE-2026-8932, was first shipped in curl version 7.7 on March 22, 2001, making it the oldest curl security issue ever reported.

curl is not just a command-line tool; it is foundational infrastructure. Running on more than 30 billion devices, it powers data transfers across operating systems, containers, CI/CD pipelines, package managers, SDKs, and automotive systems.

The wave of discoveries began on May 11, 2026, when curl founder and lead developer Daniel Stenberg announced that Anthropic's Mythos AI model had identified a single CVE in curl.

#cybersecuritynews

[FOFA @fofabot]

⚠️⚠️ CVE-2026-20896 (CVSS 9.8): Gitea Docker images default REVERSE_PROXY_TRUSTED_PROXIES=* — with reverse-proxy auth on, any IP can impersonate any user via X-WEBAUTH-USER.
🔗FOFA Link: https://t.co/w2rhVF9HFa
🎯244.5K+ Results are found on https://t.co/HSOBZfCA2r in the past year.
FOFA Query: app="Gitea"
🔖Refer: https://t.co/64ZP4hKcuj
#OSINT #FOFA #CyberSecurity #Vulnerability

[Densel @luckyhacker43]

Unauthenticated RCE in Apache Tomcat (CVE-2026-34486) 🤯🔥

🔗 https://t.co/JR2KeraObE

🔗 Join team today 👉https://t.co/FeMz53HSN0

[blackorbird @blackorbird]

PixelSmash – Critical FFmpeg Vulnerability Turns Media Files into Weapons

A critical vulnerability in FFmpeg's MagicYUV decoder leads to remote code execution via a crafted media file

https://t.co/2Wud51mqoK

[alex shapalov @alxshp]

PostgreSQL 19 is getting graph queries.

With SQL/PGQ, you can query relationships directly in SQL:

→ social networks
→ recommendations
→ fraud detection
→ dependency graphs

Postgres is not just a relational database anymore.
It’s becoming the database for everything.

https://t.co/glzueH8NYf

[鸟哥 | 蓝鸟会🕊️ @NFTCPS]

你家衣柜里那台吃灰的旧笔记本，其实是台被你白白浪费的私有云。

电池废了，处理器慢了，你舍不得扔，就让它在抽屉里躺着。但说真的，它能把你每个月交的那堆订阅费全省下来。

算笔账你就清醒了：Netflix、Google、Dropbox、1Password，加起来每月 42 刀，一年 504 刀。你花这钱，只是在租那些本该属于你的东西。

给你安利个东西，CasaOS。免费开源，一行命令，30 分钟，旧电脑直接变服务器，手机、电视、公司电脑随时随地连。装好之后内置商店里挑 App，点一下就装上：

1️⃣ Jellyfin 替 Netflix，你的电影剧集随便串流
2️⃣ Immich 替 Google Photos，人脸识别加搜索都有
3️⃣ Nextcloud 替 Dropbox，多设备同步文件
4️⃣ Vaultwarden 替 1Password，密码密钥自己管
5️⃣ 还有 Syncthing、Home Assistant、AdGuard，同步、智能家居、全屋去广告全包了

以前搭家庭服务器，装 Linux、学 Docker、写配置、修 Bug，能折腾你一整个周末。CasaOS 把这些活全干了，零代码免配置，看图标点就完事。

GitHub 34116 个星，Apache 2.0，永久免费。小团队 2021 年 9 月开始做的，树莓派、Intel NUC、旧笔记本都支持，能装超过 10 万个 Docker 应用。

最戳我的一句：你抽屉里那台被遗忘的旧笔记本，性能比 2008 年扛大多数网站的服务器还强。买个新树莓派要 50 刀，你这台成本是 0，现成的。

一行命令，三十分钟，一年省 500 刀。

你的文件、照片、电影、家，全攥回自己手里。衣柜里那台破电脑，转头就成了你的私人数据中心。

🔗 https://t.co/aoYfZHrIS5

[Seb @seblatombe]

🔴🚨 France Travail : plus d'un million de personnes potentiellement concernées par une fuite chez AKAOLIFE, éditeur de logiciels RH

Encore des données potentiellement sensibles de Français qui se retrouvent dans la nature.

Les cybercriminels affirment également détenir plus de 14 millions de lignes de données ainsi que près de 60 Go d'archives SQL, issues de plusieurs applications utilisées dans l'écosystème de France Travail.

Les cybercriminels à l'origine de la publication revendiquent notamment la possession de :

👉 966 816 dossiers RH ;
👉 1 003 047 dossiers de mobilité professionnelle ;
👉 38 138 dossiers liés au suivi de santé au travail ;
👉 3 747 dossiers relatifs à des situations de handicap ;
👉 Près de 60 Go de sauvegardes SQL réparties sur 39 bases de données ;
👉 Plus de 10 000 fichiers sources applicatifs.

[Dark Web Informer @DarkWebInformer]

🚨🇫🇷 https://t.co/E9zh32r4fS dataset allegedly leaked

https://t.co/E9zh32r4fS is the official website of France’s Ordre National des Pédicures-Podologues, the regulatory body overseeing the podiatry profession.

A forum user claims to have leaked an https://t.co/E9zh32r4fS dataset containing 8,048 records, allegedly from June 2026.

Alleged exposed data includes:

• Names
• Gender
• Addresses
• Postal codes
• Cities
• RPPS identifiers
• Detail IDs / URLs
• Telephone tokens
• Search city fields

Details:

• Target: https://t.co/E9zh32r4fS
• Country: France
• Sector: Healthcare / Professional regulator
• Claimed volume: 8,048 records
• Relevance: June 2026

Claim is unverified. Impacted professionals should monitor for phishing, impersonation, and misuse of exposed directory or contact-related data.

[Tom Dörr @tom_doerr]

Self-hosted web UI for managing your Traefik reverse proxy without manual YAML editing.

https://t.co/3l62l2uAGC

[Dark Web Informer @DarkWebInformer]

🚨 CVE-2026-45504: Microsoft Exchange File Read

CVSS: 8.8

PoC Published: June 24th, 2026
PoC: https://t.co/0K672sZL3y

Writeup: https://t.co/8oWBkdGVq7

[Censys @censysio]

🚨 CVE-2026-48908 (CVSS 10.0)

A critical flaw in Joomla's SP Page Builder can enable unauthenticated file upload and potential RCE:
▪️Versions 1.0.0–6.6.1 affected
▪️Active exploitation reported
▪️Patched in 6.6.2

Censys observed 194,793 web properties loading the component.

Full advisory: https://t.co/X1aNhUOGcG #CensysARC #CVE202648908

[小弟调调 @jaywcjlove]

vphone-cli 依托苹果 Virtualization.framework，借助PCC虚拟机底层框架实现iOS 26虚拟iPhone的启动运行。 作者 @Lakr233

[BleepingComputer @BleepinComputer]

LastPass confirms data breach in Klue supply chain attack
https://t.co/ZawDn9oFh9

https://t.co/ZawDn9oFh9

[REDasm @re_dasm]

🧵1/6
REDasm Disassembler 4.0 BETA1 is available for download.

Version 4 is a complete redesign/rewrite with a brand new engine written in plain C.

- Source Code: https://t.co/rj7lHXiIdY
- Download: https://t.co/RS4giMPiwQ

#reverseengineering #binaryanalysis #opensource

[AlternativeTo @AlternativeTo]

Free open-source Linux GUI to configure gaming mice, from DPI and profiles to LED colors and button mappings, with multiple profiles. Powered by libratbag/ratbagd