22, figuring out engineering

Joined May 2024
if i crack google deepmind research job, i will watch entire one piece
2
18
335
Today we are in a security nightmare: - Railway may have exposed customer environment variables and API keys - SBI confirmed that customer records ended up on the dark web - eMudhra's certificate keys were extremely weak (one was literally just the number 4) - LiteLLM shipped a compromised version that steals credentials and includes a backdoor - PHP released two critical remote code execution vulnerabilities (PHP2Shell) - Node.js issued urgent security patches for a Brotli decoder remote code execution flaw, plus TLS and DNS issues and blocked the compromised eMudhra certificates - Rajasthan gov systems were allegedly linked to the exposure of a large set of identity records - OpenCode confirmed a breach that exposed AI provider API keys (OpenAI, Anthropic, Google) for a portion of Console users - Plex Media Server vulnerabilities (Plex2Shell) are being actively exploited in the wild to install malware on unpatched servers - GitLab fixed a critical CVSS 10.0 unauthenticated remote code execution flaw in its CI/CD regex compiler
36
219
27
1,677
91,881
now this makes sense
Security isn’t optional in AI, it’s existential.
3
19
🚨 JFrog Security Research has identified a supply-chain attack involving malicious code in the LiteLLM 1.107.0 PyPI release. Avoid this version and investigate environments where it was installed or executed. More details will be shared soon in our blog post.
29
156
101
1,320
330,423
Some stats on #php2shell. In the 10 hours before it was publicly announced, across the @Cloudflare network we saw thousands of attempts to exploit it. That jumped to tens of thousands in the 45 minutes post announcement, hundreds of thousands within 2 hours, and millions now.
203
2,561
544
16,441
1,455,913
Not just PHP. Node.js has also announced security releases for October 21, with HIGH-severity vulnerabilities affecting its 26.x, 24.x and 22.x release lines. If you run either stack in production, keep an eye on official advisories and apply patches promptly. Security maintenance doesn't stop at your application code. Your runtime matters too. Node.js advisory: nodejs.org/en/blog/vulnerabi…
181
4,028
1,141
11,673
2,181,651
In the last 24hrs, so much has happened with development tools - > Railway is the first hand deployment tool for so many devs and companies ( 3 million users ) - compromised. > LiteLLM - Even i am using it - OS tool with 90 million + monthly downloads got compromised. > Php which covers 70% of web applications released 2 RCE security patches.
2
1
27
1,301
I got the same mail. All the things are getting so dangerous now.
Railway is compromised, rotate all API keys as soon as possible Deployments are down so don’t wait to redeploy Attackers are draining keys in real time, we didn’t lose much but can confirm this is still an active attack Stay safe friends
34
Railway is compromised, rotate all API keys as soon as possible Deployments are down so don’t wait to redeploy Attackers are draining keys in real time, we didn’t lose much but can confirm this is still an active attack Stay safe friends
114
479
173
4,509
511,957
This is too concerning
🚨 Nightmare day for cybersecurity Multiple major security incidents, active exploits, supply chain compromises... If you run production systems, start patching NOW. PHP: Two critical unauthenticated RCEs. Attackers already exploiting them. Patch NOW LiteLLM: v1.107.0 on PyPI and Docker is BACKDOORED. Steals cloud, SSH, and AI credentials. Pin 1.106.2. Rotate secrets. eMudhra: A certificate authority's keys were crackable. Update your browsers, systems, and trust stores. Node.js / Next.js / React: Security releases for Brotli RCE, TLS bypasses, and TWO critical Next.js RCEs. TiDB Cloud: PingCAP breached through stolen credentials. Customer information and other sensitive data exfiltrated. Read the attacker's release, fun stuff. Plex2Shell: Weaponized within HOURS of the PoC. Attackers already deploying cryptominers and proxy backdoors. BeyondTrust / Ivanti: Actively exploited zero-days added to CISA's KEV catalog. BeyondTrust attacks linked to a China-nexus campaign. And that's not even the full list. Patch. Audit. Rotate. NOW.
21
What in the world is going on? @Railway
5
140
If you learn AI Research Engineering, you will never be unemployed again. Stage 1: Tensor Math & Custom Autograd - Learn: PyTorch internals, custom forward/backward passes, Triton programming, memory layouts and stride calculations. - Practice: Write a custom fused attention kernel in Triton and a custom backward pass for a novel activation function without using PyTorch’s `autograd`. - Why: You cannot optimize or debug a collapsing loss curve if you treat neural networks as black-box APIs. Stage 2: Scaling Laws & Data Mixing - Learn: Chinchilla optimal compute, data deduplication (MinHash), domain-weighting and learning rate scheduling (Cosine with warm restarts). - Practice: Train a 100M parameter model on 3 different data-mix ratios (code vs. math vs. web text) and plot the exact loss divergence curves. - Why: In 2026, model architecture is secondary. The secret sauce is the exact mathematical ratio of the training data. Stage 3: Next-Gen Architectures (Beyond Transformers) - Learn: Mixture of Experts (MoE) routing, State-Space Models (Mamba/S4), linear attention and Ring Attention for infinite context. - Practice: Implement a sparse MoE routing layer with a load-balancing loss from scratch and benchmark its throughput against a dense transformer. - Why: The quadratic bottleneck of standard attention is being actively replaced. You must know the physics of the alternatives. Stage 4: Synthetic Data & Curation Pipelines - Learn: Self-instruct, evolutionary prompting, rejection sampling, and using frontier models to generate and filter training data. - Practice: Build a pipeline that uses a heavy reasoning model to generate 50,000 complex logic traces, filters them via a verifier and trains a smaller model on the survivors. - Why: The internet is running out of high-quality human text. The ability to mathematically curate synthetic data is the ultimate moat. Stage 5: Advanced Alignment & Preference Optimization - Learn: DPO (Direct Preference Optimization), KTO (Kahneman-Tversky Optimization), ORPO, reward modeling and mitigating reward hacking. - Practice: Align an SFT model using KTO (which only requires binary "good/bad" signals not paired preference data) and measure the shift in its behavioral distribution. - Why: SFT teaches a model what to say. Alignment teaches it how to behave without requiring millions of dollars in human annotation. Stage 6: Distributed Training & Systems ML - Learn: 3D Parallelism (Tensor, Pipeline, Data), DeepSpeed ZeRO-3, FSDP, NCCL communication primitives and gradient checkpointing. - Practice: Shard a 7B parameter model across 4 GPUs, profile the NCCL communication overhead and optimize the tensor-parallel boundaries. - Why: Single-GPU training is for tutorials. Production research requires sharding weights and optimizer states across clusters without bottlenecking the interconnect. Stage 7: Multimodal Fusion & Projection - Learn: Vision encoders (SigLIP, CLIP), cross-attention mechanisms, audio tokenization and early vs. late fusion architectures. - Practice: Train a lightweight MLP projection layer that maps SigLIP vision embeddings into an LLM's text embedding space to create a custom Vision-Language Model. - Why: Text is only half the internet. The 2026 meta is building models that natively reason over vision, audio and text simultaneously. Stage 8: Inference-Aware Model Design - Learn: Grouped Query Attention (GQA), Multi-Query Attention (MQA), KV-cache quantization and speculative decoding compatibility. - Practice: Modify a standard transformer to use GQA, measure the exact drop in KV-cache VRAM usage and benchmark the latency gain in vLLM. - Why: An MLE who trains a model that is too slow or expensive to serve has built a useless model. Architecture dictates inference physics. Stage 9: Mechanistic Interpretability - Learn: Activation patching, logit lens, circuit discovery and tools like TransformerLens or Baukit. - Practice: Locate the exact attention head responsible for a specific factual recall (e.g., "The Eiffel Tower is in...") and patch its activations to change the model's behavior. - Why: You cannot fix hallucinations or bias if you don't know which specific circuit in the neural network is generating them. Stage 10: Evaluation-Driven Development & Red Teaming - Learn: Contamination detection, dynamic evals, adversarial robustness and LLM-as-a-judge calibration. - Practice: Build an automated red-teaming agent that uses tree-of-thought prompting to systematically find jailbreaks in your safety classifier. - Why: Static benchmarks are easily gamed. You must build adversarial harnesses that continuously attack your own models. Stage 11: Paper-to-Production Prototyping - Learn: Rapid Arxiv reproduction, stripping academic fluff, identifying the "minimum viable kernel" of a new algorithm. - Practice: Take a brand-new Arxiv paper published this week, implement the core algorithm in <500 lines of PyTorch and benchmark it against the baseline. - Why: The speed at which you can translate academic math into working code is your primary value proposition to an AI lab. Stage 12: Open-Source Portfolio & Teardowns - Learn: HuggingFace ecosystem, writing rigorous model cards, publishing training logs and public benchmarking. - Practice: Publish a novel fine-tune, the exact synthetic data pipeline used to train it and a teardown of why the original paper's claimed results differed from your reproduction. - Why: Top AI labs hire Research Engineers based on their public HuggingFace repos and training methodologies not their degrees. Bookmark and Repost!
26
42
1
321
12,283
Dhruv retweeted
Effective Immediately, all organizations using PHP for their systems are advised to be prepared for an update addressing two critical vulnerabilities. PHP is widely used for web applications. These vulnerabilities often provide a direct path to the server's file system or database. If an immediate update is not feasible, it is recommend that organizations take the system offline until it can be fully mitigated. NSA will follow up shortly with more specific guidance.
1,174
9,834
2,551
64,690
10,566,505
found out i can do more, and my cracked personality said just do it, so giving more into this thing again again!! let's see where it takes me.
probably it will be completed today
1
5
139
bookmark this and thank me later.. cp-algorithms.com
21
105
1
1,089
86,454
– at Millbrae, CA
🚀 Introducing DeepInfer, our in-house inference framework, now fully open source! Powering DeepSeek-V4.1-Flash at scale with high throughput and low latency. We’re sharing our production stack to help the community lower compute costs, reduce energy use, and make AI more affordable. 🔗 github.com/deepseek-ai/DeepI… 1/4
11
16
2
316
6,042
watched chinese kids solving CF problems like it's just a 2 + 2 problem, now i understand their level in science and technology.
2
1
9
329
"Mathematical Theory of the Transformer" is an extensive, 825-page mathematical monograph exploring the theoretical foundations of Transformer architectures. It covers a remarkable range of topics, including embeddings and positional encoding, self-attention and multi-head attention, matrix decompositions, linear algebra, spectral analysis, information geometry, training dynamics, redundancy, optimization, and incremental Transformer architectures. This is an advanced, mathematically rigorous read for anyone interested in understanding the mathematical structures underlying Transformer-based AI systems, including modern generative AI. doi.org/10.5281/zenodo.20199…
29
262
15
1,719
70,418
Dhruv retweeted
introducing gettapmac.com your MacBook already feels every tap. now it listens. → tap once and talk, it types for you → works in any app, wherever your cursor is → Unlimited AI fixes or explains the text you select → your clipboard history and AI chat, a tap away → private, all on your Mac, no account, no subscription no shortcuts to remember, just knock meet TapMac 👊
134
43
15
310
25,166