Four infra providers post security incidents in one day — and vLLM quietly learns to page weights off SSD.
Top Signal
vLLM nightly can offload per-layer embeddings to disk
platform change
r/LocalLLaMA
vLLM's nightly builds now support disk offload for PLE (per-layer embeddings) — the trick Gemma-family models use to park a large slice of their parameters outside the accelerator. Until now those tables still had to live in VRAM or host RAM; offloading them to SSD moves the floor on what hardware can serve a PLE model at all, which is the single biggest constraint on local and small-instance deployments. Two caveats before you plan around it: it's nightly, not a release, and SSD latency has to be paid somewhere, so measure prefill and first-token time on your own hardware rather than trusting the memory number alone. What to do: if you've been sizing a box around a PLE model's embedding tables, re-run the sizing on nightly before you buy the GPU. If you serve one in production, watch for this landing in a tagged release.
Read more →
Fast Signals
Two quant vendors publicly disagree on the same DeepSeek weights
workflow
r/LocalLLaMA
Unsloth shipped Dynamic v3.1 GGUFs for DeepSeek-V4.1-Flash-1017; hours later ISTA published its own GSQ-RCO comparison stating that Unsloth's published numbers do not match theirs on the same model, with standard settings. Two quant houses contradicting each other in public on identical weights is the clearest possible signal that vendor quant tables are marketing artifacts, not measurements. Shortlist two candidates and score them on your own prompts before a deployment depends on the ranking.
Link →
Four providers disclose security incidents in one day; GitHub degrades too
platform change
HN Front Page
Linode, Bunny CDN and Northflank all posted security incidents within hours of each other, while GitHub ran a separate incident across Actions, Pages and Webhooks. None of the status pages claims a shared cause and you should not assume one, but the overlap means today is a credential day: rotate deploy keys and API tokens issued to any of them, check for tokens with broader scope than the job needs, and read each postmortem when it lands rather than the thread about it.
Link →
A working NES emulator now lives inside Qwen3.5-4B's weights
emerging signal
Simon Willison, HN Front Page
Drew Breunig baked a functioning 6502/NES emulator into Qwen3.5-4B, following Divyansh Agrawal's qwenputer RISC-V CPU earlier this week — and it hit both Simon Willison and the HN front page the same day. Past the stunt, it's the cleanest available probe of whether a 4B model can hold exact deterministic state across long step sequences, which is the failure mode behind most agent-loop drift. Read the repo if you're building anything that asks a small model to simulate a state machine.
Link →
One root cause, five cross-tenant compromises in Azure
research to practice
HN Front Page
Binary Security published a write-up tracing five separate full cross-tenant compromises in Azure to a single weak link. This is the rare security item with shipping consequences: if you run multi-tenant workloads on Azure, the post is a checklist of boundary assumptions worth re-testing against your own setup rather than news to skim.
Link →
Flash Next users report +17% average from the DFlash2 upgrade
workflow
r/LocalLLaMA
A community PSA claims a drop-in DFlash2 upgrade for Flash Next averages +17% across their suite. Single-source and self-reported, so treat the number as a reason to test rather than a result — but it's a cheap test if you already run Flash Next, and a free double-digit gain is worth an hour of eval time.
Link →
Radar
Arsaze: tab-complete and agent edits for video
Applies the Cursor interaction model — inline completion plus agentic edits — to a video timeline rather than a text buffer. Worth watching as evidence of which editor affordances generalise off text, and which don't.
Link →
OpenMausBot hands each bot its own virtual machine
An open-source bot framework whose agents get a VM to work in, newly trending with a small footprint. Same architectural bet as CopilotKit/OpenBot but from an individual dev — bookmark if you need a sandbox per agent without building the isolation layer yourself.
Link →
Tangled: a federated code forge on atproto
Git hosting federated over atproto, posted the same day GitHub degraded Actions, Pages and Webhooks. Not production-ready for your CI, but the first credible answer to a question most teams only ask during an outage.
Link →
Gemma-4-31B finetuned against "LLM voice"
A community finetune of official Gemma 4 31B targeting human-sounding prose, arriving a day after Fowler named the LLM-voice problem. If you generate user-facing copy, it's a concrete baseline to A/B rather than another prompt-engineering guess.
Link →
Convergence Watch
nesformer
TRENDING
2 mentions across Simon Willison, HN Front Page
Second weight-baked CPU this week after qwenputer's RISC-V build on 10-28, and the first to cross sources independently. The technique — fine-tuning a 4B model into an exact state machine — is becoming a shared benchmark for deterministic reasoning in small models rather than a one-off stunt.
provider security incidents
5 mentions across HN Front Page
Linode, Bunny, Northflank, GitHub and an Azure cross-tenant write-up on one front page. One source feed, but five independent companies — a clustering worth noting without inferring a shared cause nobody has claimed. Actionable as a credential-rotation and token-scope audit day.
deepseek-v4.1-flash-1017
2 mentions across r/LocalLLaMA
Two competing quant releases and a public methodology dispute on the same day. Continues the 10-24 thread that KLD-style tables are not leaderboards; the practical read is that quant selection is now a per-task measurement, not a lookup.
local hardware capex
TRENDING
1 mentions across r/LocalLLaMA
Fourth day in seven. Reported AMD Radeon price increases for November point the opposite way to last week's A100 glut chatter — consumer VRAM gets more expensive while datacentre supply loosens. If your plan assumed falling local hardware costs, the cheap path may be used enterprise parts, not new cards.