#https

🔥牛逼了！12GB显卡本地跑763B！DeepSeek-V4.1-Flash-1017量化版炸裂登场，前沿质量几乎零损失！ ISTA-DASLab团队发布GSQ-RCO非均匀量化版，Strata引擎原生支持。763B参数MoE大模型最低压到1.75 bpw，在消费级硬件上就能跑！ 核心亮点 🔹极致压缩 + 几乎无损：IQ2_XXS（2.00 bpw，约249GB）在AIME25、GPQA-Diamond、LiveCodeBench v6上100%恢复原始模型分数；IQ1_M（1.75 bpw，约231GB）整体恢复98.7%。 🔹真正本地可行：单张12GB显卡 + 46-64GB系统内存即可运行，Engram表（约111GB）直接SSD内存映射，无需全部装进内存/显存。 🔹推理速度可玩：RTX 3060上IQ2_XXS约8-10 tok/s；更高端卡更快。原生OpenAI兼容API，支持推理effort调节。 🔹技术硬核：GSQ（Gumbel-Softmax量化）+ RCO（黎曼约束优化）联合，非均匀分配每个tensor的量化类型，远超普通均匀量化。 快速上手步骤 1️⃣一键安装Strata（Windows/Linux脚本或安装包）：
curl -fsSL | sh（Linux/Mac） 2️⃣启动并自动下载模型：
strata launch --model ist-das-2.00bpw（推荐2.00 bpw；或ist-das-1.75bpw / ist-das-2.25bpw） 3️⃣等待下载完成（首次需约240-270GB空间，SSD优先），引擎会自动启动本地服务。 4️⃣直接调用：http://127.0.0.1:8080/v1（OpenAI格式）或用配套桌面端/终端交互。 5️⃣高级用户可手动下载GGUF后指定路径： 这是本地AI的又一次质变——763B级别模型从服务器走进游戏本/工作站。 Strata引擎： #DeepSeek #LocalAI #GSQ #RCO #Strata #开源大模型 #消费级AI #MoE #量化革命

💥苹果党码住！只需一台Mac把 DeepSeek-V4.1-Flash 1017 直接干到每秒100+ token！ 在单台M5 Ultra，80核GPU + 256GB上，用mlx-serve把刚发布的DeepSeek-V4.1-Flash-1017跑通 核心亮点： 🔹生成速度稳定102～112 tok/s，峰值冲到136.7 tok/s 🔹Prefill读prompt飙到1770 tok/s 🔹短问题首字约0.5秒，16k长上下文约9秒出字 🔹3-bit量化（iQ-MLX-3.0bpw），token匹配率89.8%，困惑度仅+3.6% 🔹自带DSpark草稿层 + prompt lookup加速，跑coding agent尤其猛 快速上手（256GB M5 Ultra用户最划算）： 1️⃣升级到macOS 26.10.3预发布版 2️⃣下载MLX-Serve App（或brew安装） 3️⃣打开App，Model Browser搜索DeepSeek-V4.1-Flash下载对应quant 4️⃣直接聊天 / 用Claude Code、Codex等工具连本地端口（兼容OpenAI/Anthropic/Ollama） 完全本地、无需Python、MIT开源，写代码/跑agent神器。 #DeepSeekV41Flash1017 #Mac #LocalAI #MLX #AppleSilicon #M5Ultra #AI #开源 #本地部署 #苹果电脑

10 GitHub repos to automate work, not just generate answers. Trading research, ad campaigns, email, browsing and video production:  1.⁠ ⁠AutoHedge An AI-agent framework for automated trading research and execution. ⁠ ⁠  2.⁠ ⁠Vibe-Trading Build your own AI trading agent. ⁠ ⁠  3.⁠ ⁠Claude Ads Audit and optimize ad campaigns with Claude Code. ⁠ ⁠  4.⁠ ⁠TopRank Automate SEO and Google Ads workflows. ⁠ ⁠  5.⁠ ⁠Fincept Terminal Financial research and market analytics in one terminal. ⁠ ⁠  6.⁠ ⁠Agentic Inbox Use AI agents to manage email workflows. ⁠ ⁠  7.⁠ ⁠ClawRouter Route context for AI agents. ⁠ ⁠  8.⁠ ⁠Camofox Browser A browser built for agent automation, with anti-detection features. ⁠ ⁠  9.⁠ ⁠Open Higgsfield AI An open-source interface for AI video generation. ⁠ ⁠ 10.⁠ ⁠HyperFrames Let your agent write HTML and render it into video. ⁠ ⁠ These automate workflows, not guarantee income. Hosting and model costs can still apply. Save this before building your next automation from scratch.

1/ HTTP has a status code for payments that was never really used: 402 Payment Required x402 is an open standard that puts it to work A server asks for payment inside a normal request, and a client, like an AI agent, pays without a checkout page or an account... kinda genius

Working RCE against PHP 8.5.12 (the 2026-10-21 security release that fixed CVE-2026-109618/109619). Pure logic bug — no memory corruption, ASAN-clean, orthogonal to the CVE-2026-109618/19 class. Receipt: uid=33(www-data) over HTTP, one-shot #infosec #php2shell #php

.... Dude the internet is cooked .... This can't be patched out 😈... #CyberSecurity #infosec

AI agents can't walk into a room. @vangrid_io lets them request a capture with one HTTP call and pay in USDC. Humans become the agent's eyes. Odd idea, but it fits where agents are heading.

$Requests 60k mcap Creator of the python HTTP request library. 54k stars 40Billion downloads. Thats pretty big. Hes posted CA in bio too. 6ceuPfcE67PLs3Z6CbJpFpqNyAevVocP2zsDkbM1pump

Hello, world! I am known as Kenneth Reitz, the original creator of the legendary Requests: HTTP for Humans project. Thank you so much for creating this community.

rx402: private x402 payments for agents, on Sodi. rx402 lets an agent pay for an API with an HTTP 402 response and a stablecoin transfer. The catch: every payment comes from the agent’s wallet, so anyone can link every call it makes back to its owner. rx402 breaks that link. The owner deposits USDG into a privacy pool on Robinhood Chain, and an approval service screens deposits before they can be spent. The agent opens a session: a zero-knowledge proof that it owns funds in the pool, and a withdrawal of a small budget to a brand-new address. A relayer pays the gas, so nothing funds that address traceably. From there the agent pays x402 endpoints (data feeds, APIs, inference) like any other wallet, and rotates to a fresh address when the budget runs out. Merchants see an ordinary payment. Nobody can link a session to the owner, or to the next session. SDK (@sodi/rx402), MCP server and contracts, open source:

🔒 HTTP vs HTTPS: What does “Not Secure” really mean? HTTPS encrypts your connection, but the padlock doesn’t guarantee a website is trustworthy. Scam sites can use HTTPS too! 👀 #CyberSecurity #HTTPS #Sparient

Bun AOT also introduces `--trim` which deletes unused parts of Bun from the compiled binary On macOS, a binary that uses Bun.serve’s HTTP server goes from 89 MB to 25 MB

Q: Can AI agents hire people through Vangrid? A: Yes, per the docs. An agent sends one HTTP request, pays in USDC on Base or Arc through x402, and a contributor goes to film the place. Q: How much of the bounty board is agents? A: One of 973 bounties, per an independent read of the public board on 19 October 2026. Q: So is the agent path real? A: The path exists and is documented. The board says usage is early. Both can be true. Q: Where does that number move? A: On the board at so check there before repeating mine. Capability and usage are different columns, ngl, and coverage tends to fill in only the first one. has the path, covers the product, and @vangrid_io is the account behind it.

An independent write-up read Vangrid's public pages on 19 October 2026. The numbers are a good lesson in why counters need their definitions. Captures: 1,304,193. Footage fingerprints recorded. Events: 2,644,152. Captures plus accesses, so more than double the capture count and not a measure of footage. Trees: 5,356 listed on the explorer, 5,175 anchored. 181 weren't anchored yet at that moment. Bounties: $636,514 created and funded, of which $620,030 accepted, 942 out of 973. Four counters, four questions: how much footage, how much activity, how much is anchored, how much money moved. Quote one without its definition and it says something it doesn't. That was one afternoon's reading and the pages update constantly, so confirm on and before repeating any of it. @vangrid_io is the account behind it, and has the product.

We made a website to check if your http client is vulnerable to CVE-2026-111497 (Node2Shell/HTTP2Shell) Also open-source: Some examples:

How HTTPS Actually Works: The Padlock, Explained (TLS 1.3) Every time the padlock appears, two machines that have never met agree on a secret in plain sight, in a fraction of a second. #HTTPS #TLS

Access: "POST /wordpress/wp-content/index.php HTTP/1.1" 500 210 33554686 110647 "-" "arm-r1" Error: PHP Fatal error: Allowed memory size of 16777216 bytes exhausted at /usr/src/php-8.5.4/main/rfc1867.c:632 ... in Unknown on line 0

⚠️🚨 THIS IS NOT A DRILL 🚨⚠️ Google has officially declared a bug in Brotli, its tool that shrinks web traffic, CRITICAL: 9.2 out of 10. Last night "Node2Shell" evolved into HTTP2SHELL. A formal CVE record has been issued citing CVE-2026-111497 -- a hole in versions 1.0.3 to 1.2.0 that can hit any app unpacking data from strangers, and could let them take it over. What this means: ▪️ This is not a Node.js problem anymore. This is an HTTP PROBLEM. ▪️ Every unpatched app across Node.js, Python, Bun, and Envoy that unpacks Brotli now has a hole attackers need no login to use ▪️ Istio. curl. Python's requests and httpx. All at risk under one CVE. ▪️ EVERY project that bundles Brotli must ship its own fix, and not all are out yet This changes everything. A normal bug can be fixed in one place. A 9.2 bug inside a shared tool cannot. We just entered the most dangerous phase of this crisis. If you're not paying attention - start now. Save this. Share this. This is the moment it escalated beyond return.

A hacker gained root on PHP target box after 19 hours and claimed the 2.5M sat prize. The exploit chains three stages against PHP 8.4.26 on Alpine: a heap leak, a code leak, and a forged HashTable callback that reaches system(), all in 20 HTTP requests with no looping or retries. Full PoC is published on GitHub.

php2shell-bypass-aslr-exp — Pure-HTTP exploit achieving RCE on PHP 8.4.26 + Apache mod_php via session upload_progress heap leak, dangling pointer reuse, and ASLR bypass to call zif_system.

it's f*cking gold Claude Code can turn reverse engineering into an AI powered investigation lab 18 GitHub tools to inspect Android apps, analyze binaries, trace network traffic, and rebuild software from verified evidence GIVE AI THE FULL TOOLBOX 01 REA ▸ → connect an AI assistant to reverse engineering tools through MCP DECOMPILE THE CODE 02 Ghidra ▸ → decompile binaries and inspect program structure 03 GhidraMCP ▸ → expose Ghidra analysis tools to AI agents 04 IDA Pro MCP ▸ → let agents inspect functions and cross references in IDA REVERSE ENGINEER MOBILE APPS 05 JADX ▸ → recover Java like source from Android APKs 06 Apktool ▸ → decode and rebuild Android application resources 07 Frida ▸ → instrument running applications for dynamic analysis 08 ILSpy ▸ → decompile and inspect .NET assemblies ANALYZE BINARIES 09 radare2 ▸ → inspect machine code, functions, and binary structures 10 x64dbg ▸ → debug Windows applications at runtime 11 ImHex ▸ → inspect binary formats with patterns and hex analysis 12 angr ▸ → explore program behavior using symbolic execution TRACE NETWORK BEHAVIOR 13 mitmproxy ▸ → inspect HTTP traffic in authorized test environments 14 dnSpyEx ▸ → debug and inspect managed .NET applications 15 rizin ▸ → analyze executable files and disassembly 16 raddebugger ▸ → debug native programs with a visual interface REBUILD FROM EVIDENCE 17 Awesome AI Reverse Engineering ▸ → discover AI assisted reverse engineering tools 18 Awesome Reverse Engineering ▸ → find curated resources for binary analysis Start with software you own or have permission to analyze 1 → Decompile the target with Ghidra or JADX 2 → Collect function names, cross references, and observed behavior 3 → Feed the evidence into Claude Code with a strict analysis prompt 4 → Write SPEC.md describing inputs, outputs, and edge cases 5 → Implement an independent version from the specification 6 → Run comparison tests and repeat until the documented behavior matches COPY THIS PROMPT: " Analyze the supplied reverse engineering evidence Separate verified behavior from assumptions Produce SPEC.md with inputs, outputs, state transitions, and edge cases Propose an independent implementation based only on authorized evidence Generate tests for every documented behavior Flag anything that cannot be verified " The expensive part of reverse engineering isn't opening a decompiler It's turning thousands of disconnected observations into a specification you can actually implement and test 18 tools, one investigation workflow, a reproducible path from evidence to working code should I write the full guide to building this with Claude Code?

How long does it take to become an Ethical Hacker? Foundation = 1–3 Months (Networking, Linux, Windows, TCP/IP, Cybersecurity Basics) Programming = 2–4 Months (Python, Bash, PowerShell, Git, Automation Scripts) Web Hacking = 4–8 Months (HTTP/HTTPS, HTML, JavaScript, OWASP Top 10, Burp Suite) Network Penetration Testing = 6–12 Months (Nmap, Wireshark, Metasploit, SMB, Active Directory, Privilege Escalation) Bug Bounty Hunting = 6–18 Months (Recon, Subdomain Enumeration, XSS, SQLi, SSRF, API Security, Reporting) Red Teaming = 1–2 Years (Phishing, Initial Access, C2 Frameworks, Lateral Movement, Evasion Techniques) Wireless Hacking = 3–6 Months (Wi-Fi Security, WPA/WPA2, Evil Twin, Aircrack-ng, Bluetooth Attacks) Cloud Pentesting = 6–12 Months (AWS, Azure, IAM, Kubernetes, Docker, Cloud Misconfigurations) Mobile Application Hacking = 6–12 Months (Android, iOS, Frida, MobSF, Reverse Engineering, API Testing) Expert Ethical Hacker = 2–5+ Years (Advanced Exploit Development, Reverse Engineering, Malware Analysis, Active Directory Attacks, Custom Tools, Real-World Engagements)

Hoy el Internet amaneció en llamas: un agujero en PHP (70% de los sitios web) y certificados HTTPS falsos. Europa está recomendando apagar los servidores que no se puedan parchar. Lo que sí podés hacer: actualizar tu browser. #ciberseguridad #PHP #HTTPS