A brotli CVE just put RCE in your HTTP stack, and the Nvidia unlock now doubles prefill on 40-series.
Top Signal
Brotli CVE turns Node2Shell into HTTP2Shell across HTTP libraries
platform change
HN Front Page
Aikido's writeup escalates the Node2Shell class of bugs into HTTP2Shell: CVE-2026-111497 in brotli decompression reaches far past Node, hitting Python packages and a long tail of HTTP clients and servers that transparently decode `Content-Encoding: br`. The blast radius is the problem — you probably do not import brotli directly; your HTTP library does, and it decompresses attacker-controlled response bodies by default. Any service that fetches untrusted URLs is exposed, which includes essentially every agent with a web-fetch tool, every RAG crawler, and every webhook consumer. Today: audit your lockfiles for brotli bindings (`uv pip list`, `npm ls` transitively), upgrade or pin, and for agent fetch tools consider disabling br in the Accept-Encoding header until patched. The related HN front-pager — a live "Steal My Bitcoin" bounty on the PHP RCE the community spent the week panicking over — shows attackers are already probing this class in public.
Read more →
Fast Signals
GPU unlock spreads to RTX 40-series, doubles prefill
workflow
HN Front Page, r/LocalLLaMA
Zagitta's gpu-unlock repo hit the HN front page and the technique now generalizes past the 3090 — the CMP170HX-derived trick raises FP/BF16 instruction issue rate on both 30- and 40-series cards, with reports of up to 2x prefill speedup. This is free throughput on hardware you already own, and the second independent source in two days. Test on a non-production box first; vendor sanction is nonexistent.
Link →
KLD is not a quant leaderboard — stop ranking by it
research to practice
r/LocalLLaMA
A detailed r/LocalLLaMA teardown argues KL divergence can tell you a quant is broken but cannot finely rank quants that are all roughly fine — the number is dominated by easy-token agreement, not the rare divergences that actually wreck output. With Gyro, IQ*_K, and GSQ-RCO all competing on KLD charts this week, that matters. Pick quants with a task-shaped eval, not a single scalar.
Link →
262K context coder on an 8GB GPU at 70 tok/s
workflow
r/LocalLLaMA
A posted llama.cpp config runs Qwen-Flash-Next Coder at 3.5 BPW with 262K context on a single 8GB card, generating ~70 tok/s. If you've been assuming long-context agentic coding requires 24GB+, this is the config to copy. Worth reproducing before you buy more VRAM.
Link →
ANEMLL Forge 0.2.1 puts Qwen3.8-27B on the M6 Neural Engine
new tool
r/LocalLLaMA
192K context on a 32GB M6 Mac Mini, with new INT8 K/V cache (half of FP16) and a drafter that shares the target's output head — 0.86GB less ANE memory at the same speed. The Neural Engine path leaves the GPU and CPU free, which matters if the model is one component of a larger local app. Underrated toolchain; almost nobody outside this subreddit is tracking it.
Link →
Kimi strips cyberattack data from K3.1 open weights
platform change
r/LocalLLaMA
Moonshot is removing cyberattack-related training data from the open-weight K3.1 release, citing China's export restrictions. Open weights are now being capability-trimmed before release, not just RLHF'd — which changes what you can expect from them on security, reverse engineering, and sysadmin work. Expect inference-time abliteration tooling to fill the gap rather than fine-tunes.
Link →
AbliteratedOutTheBox: inference-time abliteration, no fine-tune
new tool
r/LocalLLaMA
A llama.cpp fork (now ported to Strata) that applies abliteration as a runtime hook rather than producing a separate uncensored checkpoint — no extra VRAM, no training run, works on stock weights. Directly answers the recurring "I need a model that won't refuse reverse-engineering work" problem. Treat as research tooling; the same hook is a straightforward safety bypass.
Link →
Corgi: an agent/terminal multiplexer built as a daily driver
new tool
HN Show
A Show HN agent multiplexer in the Herdr lineage, with a running activity feed so you can see what each parallel agent is actually doing instead of tab-hopping blind. Observability-first is the right ergonomic bet for multi-agent work. Bookmark for when you're running more than three agents at once.
Link →
Silero VAD v6 appears inside ChatGPT voice mode
emerging signal
r/LocalLLaMA
Users spotted Silero's open-source voice activity detector shipping in OpenAI's voice stack. If a frontier lab's realtime pipeline is fine with a tiny permissive VAD, your voice agent does not need a bespoke turn-detection model either. Drop it in and spend the effort elsewhere.
Link →
Radar
Gyro quants: closed-source format spreading into engines
A new quant format is being adopted across inference engines (notably Strata) while keeping parts of its implementation closed, and a code-level comparison suggests it looks a lot like EXL3. Watch this: opaque quantization in your serving path is a reproducibility and supply-chain question, not just a quality one.
Link →
llama.cpp fork revives Kepler, adds CUDA graphs + Windows NCCL
A performance fork targeting legacy Nvidia cards brings CUDA graphs and multi-GPU NCCL on Windows to hardware mainline dropped. With 3090 prices surging, decade-old datacenter cards become a plausible cheap inference tier again.
Link →
Raon-1-mini-preview: KRAFTON's small model, barely covered
A game studio quietly shipped GGUFs for a small model that one practitioner claims outperforms Flint by a wide margin. Unverified and single-source, but non-lab small models from unexpected orgs have been the best value finds this month.
Link →
Four neural nets doing realtime audio analysis in a browser tab
An open-source rhythm game runs four small models on your song live, in-page, with no server. The interesting part isn't the game — it's a working reference for shipping multi-model realtime inference to a browser.
Link →
Convergence Watch
nvidia gpu unlock
TRENDING
2 mentions across HN Front Page, r/LocalLLaMA
Second straight day, and it jumped from a single subreddit to the HN front page while the technique broadened from 3090s to the 30- and 40-series with ~2x prefill gains. Source spread plus scope expansion is the reliable early pattern. Expect vendor pushback and a wave of forks within the week.
qwen3.8
TRENDING
4 mentions across r/LocalLLaMA
Five of the last seven days, and today it is the substrate rather than the news: 8GB long-context coder configs, Apple Neural Engine ports, motion-graphics output rivaling Opus 5.5, and requests for Blender fine-tunes. When a model stops being discussed and starts being assumed, it has become the local default.
kimi k3.1
TRENDING
2 mentions across r/LocalLLaMA, Simon Willison
Carried over from yesterday's API launch into skepticism today — practitioners are comparing it unfavorably to DeepSeek-V4.1-Flash on size-adjusted quality, and the open-weight drop promised for Nov 4 is now also known to be capability-trimmed. Wait for the weights before planning around it.
abliteration
3 mentions across r/LocalLLaMA
Three independent threads today — Kimi stripping cyberattack data pre-release, a runtime abliteration engine landing in Strata, and a request for an RE-capable local model. Single-source so far, but the shape is clear: open-weight capability restriction is creating a tooling market to undo it. Watch for this to reach HN.