Dhruv retweeted
Today we are in a security nightmare:
- Railway may have exposed customer environment variables and API keys
- SBI confirmed that customer records ended up on the dark web
- eMudhra's certificate keys were extremely weak (one was literally just the number 4)
- LiteLLM shipped a compromised version that steals credentials and includes a backdoor
- PHP released two critical remote code execution vulnerabilities (PHP2Shell)
- Node.js issued urgent security patches for a Brotli decoder remote code execution flaw, plus TLS and DNS issues and blocked the compromised eMudhra certificates
- Rajasthan gov systems were allegedly linked to the exposure of a large set of identity records
- OpenCode confirmed a breach that exposed AI provider API keys (OpenAI, Anthropic, Google) for a portion of Console users
- Plex Media Server vulnerabilities (Plex2Shell) are being actively exploited in the wild to install malware on unpatched servers
- GitLab fixed a critical CVSS 10.0 unauthenticated remote code execution flaw in its CI/CD regex compiler
Dhruv retweeted
🚨 JFrog Security Research has identified a supply-chain attack involving malicious code in the LiteLLM 1.107.0 PyPI release. Avoid this version and investigate environments where it was installed or executed. More details will be shared soon in our blog post.
Dhruv retweeted
Some stats on #php2shell. In the 10 hours before it was publicly announced, across the @Cloudflare network we saw thousands of attempts to exploit it. That jumped to tens of thousands in the 45 minutes post announcement, hundreds of thousands within 2 hours, and millions now.
Dhruv retweeted
Not just PHP. Node.js has also announced security releases for October 21, with HIGH-severity vulnerabilities affecting its 26.x, 24.x and 22.x release lines.
If you run either stack in production, keep an eye on official advisories and apply patches promptly.
Security maintenance doesn't stop at your application code. Your runtime matters too.
Node.js advisory: nodejs.org/en/blog/vulnerabi…
Dhruv retweeted
In the last 24hrs, so much has happened with development tools -
> Railway is the first hand deployment tool for so many devs and companies ( 3 million users ) - compromised.
> LiteLLM - Even i am using it - OS tool with 90 million + monthly downloads got compromised.
> Php which covers 70% of web applications released 2 RCE security patches.
An urgent notice from the Railway team
blog.railway.com/p/security-…
An urgent notice from the Railway team
blog.railway.com/p/security-…
I got the same mail. All the things are getting so dangerous now.
Dhruv retweeted
Railway is compromised, rotate all API keys as soon as possible
Deployments are down so don’t wait to redeploy
Attackers are draining keys in real time, we didn’t lose much but can confirm this is still an active attack
Stay safe friends
This is too concerning
🚨 Nightmare day for cybersecurity
Multiple major security incidents, active exploits, supply chain compromises...
If you run production systems, start patching NOW.
PHP: Two critical unauthenticated RCEs. Attackers already exploiting them. Patch NOW
LiteLLM: v1.107.0 on PyPI and Docker is BACKDOORED. Steals cloud, SSH, and AI credentials. Pin 1.106.2. Rotate secrets.
eMudhra: A certificate authority's keys were crackable. Update your browsers, systems, and trust stores.
Node.js / Next.js / React: Security releases for Brotli RCE, TLS bypasses, and TWO critical Next.js RCEs.
TiDB Cloud: PingCAP breached through stolen credentials. Customer information and other sensitive data exfiltrated. Read the attacker's release, fun stuff.
Plex2Shell: Weaponized within HOURS of the PoC. Attackers already deploying cryptominers and proxy backdoors.
BeyondTrust / Ivanti: Actively exploited zero-days added to CISA's KEV catalog. BeyondTrust attacks linked to a China-nexus campaign.
And that's not even the full list.
Patch. Audit. Rotate. NOW.
Dhruv retweeted
If you learn AI Research Engineering, you will never be unemployed again.
Stage 1: Tensor Math & Custom Autograd
- Learn: PyTorch internals, custom forward/backward passes, Triton programming, memory layouts and stride calculations.
- Practice: Write a custom fused attention kernel in Triton and a custom backward pass for a novel activation function without using PyTorch’s `autograd`.
- Why: You cannot optimize or debug a collapsing loss curve if you treat neural networks as black-box APIs.
Stage 2: Scaling Laws & Data Mixing
- Learn: Chinchilla optimal compute, data deduplication (MinHash), domain-weighting and learning rate scheduling (Cosine with warm restarts).
- Practice: Train a 100M parameter model on 3 different data-mix ratios (code vs. math vs. web text) and plot the exact loss divergence curves.
- Why: In 2026, model architecture is secondary. The secret sauce is the exact mathematical ratio of the training data.
Stage 3: Next-Gen Architectures (Beyond Transformers)
- Learn: Mixture of Experts (MoE) routing, State-Space Models (Mamba/S4), linear attention and Ring Attention for infinite context.
- Practice: Implement a sparse MoE routing layer with a load-balancing loss from scratch and benchmark its throughput against a dense transformer.
- Why: The quadratic bottleneck of standard attention is being actively replaced. You must know the physics of the alternatives.
Stage 4: Synthetic Data & Curation Pipelines
- Learn: Self-instruct, evolutionary prompting, rejection sampling, and using frontier models to generate and filter training data.
- Practice: Build a pipeline that uses a heavy reasoning model to generate 50,000 complex logic traces, filters them via a verifier and trains a smaller model on the survivors.
- Why: The internet is running out of high-quality human text. The ability to mathematically curate synthetic data is the ultimate moat.
Stage 5: Advanced Alignment & Preference Optimization
- Learn: DPO (Direct Preference Optimization), KTO (Kahneman-Tversky Optimization), ORPO, reward modeling and mitigating reward hacking.
- Practice: Align an SFT model using KTO (which only requires binary "good/bad" signals not paired preference data) and measure the shift in its behavioral distribution.
- Why: SFT teaches a model what to say. Alignment teaches it how to behave without requiring millions of dollars in human annotation.
Stage 6: Distributed Training & Systems ML
- Learn: 3D Parallelism (Tensor, Pipeline, Data), DeepSpeed ZeRO-3, FSDP, NCCL communication primitives and gradient checkpointing.
- Practice: Shard a 7B parameter model across 4 GPUs, profile the NCCL communication overhead and optimize the tensor-parallel boundaries.
- Why: Single-GPU training is for tutorials. Production research requires sharding weights and optimizer states across clusters without bottlenecking the interconnect.
Stage 7: Multimodal Fusion & Projection
- Learn: Vision encoders (SigLIP, CLIP), cross-attention mechanisms, audio tokenization and early vs. late fusion architectures.
- Practice: Train a lightweight MLP projection layer that maps SigLIP vision embeddings into an LLM's text embedding space to create a custom Vision-Language Model.
- Why: Text is only half the internet. The 2026 meta is building models that natively reason over vision, audio and text simultaneously.
Stage 8: Inference-Aware Model Design
- Learn: Grouped Query Attention (GQA), Multi-Query Attention (MQA), KV-cache quantization and speculative decoding compatibility.
- Practice: Modify a standard transformer to use GQA, measure the exact drop in KV-cache VRAM usage and benchmark the latency gain in vLLM.
- Why: An MLE who trains a model that is too slow or expensive to serve has built a useless model. Architecture dictates inference physics.
Stage 9: Mechanistic Interpretability
- Learn: Activation patching, logit lens, circuit discovery and tools like TransformerLens or Baukit.
- Practice: Locate the exact attention head responsible for a specific factual recall (e.g., "The Eiffel Tower is in...") and patch its activations to change the model's behavior.
- Why: You cannot fix hallucinations or bias if you don't know which specific circuit in the neural network is generating them.
Stage 10: Evaluation-Driven Development & Red Teaming
- Learn: Contamination detection, dynamic evals, adversarial robustness and LLM-as-a-judge calibration.
- Practice: Build an automated red-teaming agent that uses tree-of-thought prompting to systematically find jailbreaks in your safety classifier.
- Why: Static benchmarks are easily gamed. You must build adversarial harnesses that continuously attack your own models.
Stage 11: Paper-to-Production Prototyping
- Learn: Rapid Arxiv reproduction, stripping academic fluff, identifying the "minimum viable kernel" of a new algorithm.
- Practice: Take a brand-new Arxiv paper published this week, implement the core algorithm in <500 lines of PyTorch and benchmark it against the baseline.
- Why: The speed at which you can translate academic math into working code is your primary value proposition to an AI lab.
Stage 12: Open-Source Portfolio & Teardowns
- Learn: HuggingFace ecosystem, writing rigorous model cards, publishing training logs and public benchmarking.
- Practice: Publish a novel fine-tune, the exact synthetic data pipeline used to train it and a teardown of why the original paper's claimed results differed from your reproduction.
- Why: Top AI labs hire Research Engineers based on their public HuggingFace repos and training methodologies not their degrees.
Bookmark and Repost!
Effective Immediately, all organizations using PHP for their systems are advised to be prepared for an update addressing two critical vulnerabilities. PHP is widely used for web applications. These vulnerabilities often provide a direct path to the server's file system or database. If an immediate update is not feasible, it is recommend that organizations take the system offline until it can be fully mitigated. NSA will follow up shortly with more specific guidance.
found out i can do more, and my cracked personality said just do it, so giving more into this thing again again!! let's see where it takes me.
Dhruv retweeted
bookmark this and thank me later..
cp-algorithms.com
Dhruv retweeted
– at Millbrae, CA
🚀 Introducing DeepInfer, our in-house inference framework, now fully open source!
Powering DeepSeek-V4.1-Flash at scale with high throughput and low latency. We’re sharing our production stack to help the community lower compute costs, reduce energy use, and make AI more affordable.
🔗 github.com/deepseek-ai/DeepI…
1/4
watched chinese kids solving CF problems like it's just a 2 + 2 problem, now i understand their level in science and technology.
Dhruv retweeted
"Mathematical Theory of the Transformer" is an extensive, 825-page mathematical monograph exploring the theoretical foundations of Transformer architectures.
It covers a remarkable range of topics, including embeddings and positional encoding, self-attention and multi-head attention, matrix decompositions, linear algebra, spectral analysis, information geometry, training dynamics, redundancy, optimization, and incremental Transformer architectures.
This is an advanced, mathematically rigorous read for anyone interested in understanding the mathematical structures underlying Transformer-based AI systems, including modern generative AI.
doi.org/10.5281/zenodo.20199…
introducing gettapmac.com
your MacBook already feels every tap. now it listens.
→ tap once and talk, it types for you
→ works in any app, wherever your cursor is
→ Unlimited AI fixes or explains the text you select
→ your clipboard history and AI chat, a tap away
→ private, all on your Mac, no account, no subscription
no shortcuts to remember, just knock
meet TapMac 👊
























