2026-10-22

AI/Tech Digest 2026-10-22

RecursiveSI/flint (40B A2.5B) · Hugging Face [LAB]
A new 40B total / 2.5B active MoE release directly matches the reader’s focus on mid-size MoE architectures for local/edge inference.
https://www.reddit.com/r/LocalLLaMA/comments/1xbqik0/recursivesiflint_40b_a25b_hugging_face/ (reddit.com)
How Specializing the Vocabulary of SLMs Can Cut Inference Cost by 77% in Real Applications [LAB]
Concrete inference-cost research for small language models is directly relevant to local serving and efficiency work.
https://huggingface.co/blog/Dharma-AI/vocabx-vocabulary-specialization (huggingface.co)
Profiling TorchNeuron (Part 1): System-level profiling on AWS Trainium. [LAB]
Hardware-level profiling for model workloads is relevant to performance tuning, though less local than GPU-focused items.
https://huggingface.co/blog/amazon/profiling-torchneuron-part-1 (huggingface.co)

Today's PHP Security Release, and How We're Strengthening PHP Security [LAB]
If you run PHP services, this is a direct upgrade signal with real security impact.
https://simonwillison.net/2026/Oct/21/php-security-release/ (simonwillison.net)
Railway Security Disclosure [LAB]
A platform-level security disclosure can affect hosted apps and infrastructure decisions.
https://blog.railway.com/p/security-disclosure-wednesday-october-21st (blog.railway.com)

Node.js security release — Brotli decoder RCE (CVE-2026-111497, High) [RECORDED 2026-10-22 22:12 HKT, from Threads @blockchaintipstw101]
Official advisory dated Wed Oct 21, 2026: fixes for 26.x / 24.x / 22.x. Headline: Brotli decoder out-of-bounds write enabling RCE (reported by OpenAI Codex Security), plus TLS hostname-bypass ×2 (fullwidth-digit IP, loose host resolution), dns.resolve NUL truncation (all High), keep-alive response bleed, non-canonical IPv4 cert validation, and snapshot-seeded crypto.randomUUID/randomInt entropy reuse (Medium). Dependency bumps: c-ares, ca-cert (eMudhra intermediate CA compromise), OpenSSL, SQLite, Undici.
Fixed versions (verified live on nodejs.org): 26.12.1, 24.22.1, 22.23.4 — all three are current latest. Threads post accurate; note the two TLS bypasses and entropy-cache bug it omits.
https://nodejs.org/en/blog/vulnerability/october-2026-security-releases (nodejs.org)