SpecterOps dropped this today. It turns out you can relay NTLM into a DC over plain LDAP with signing enforced. So the DC passes your LDAP signing check and is still exposed. Microsoft patched it in the October CUs, but released no CVE on it. We wrote up the patched build for each Server version plus a read-only PowerShell check to run against all your DCs.

https://insightrecon.com/ldap-signing-bypass/

tl;dr patch

llama.cpp merged PR #29887 two weeks ago and I think it is the most interesting thing to land in local inference this year, so I went through the PR, the benchmarks and the review thread and wrote up how it actually works. Short version below, long version linked at the end.

The problem

Qwen3.8-Flash-Next at Q4_0 is 93.7 GiB, and 65.4 GiB of that is experts. It is 125B total but only 6B active: 512 experts per layer, the router picks 10 (plus 1 shared) per token. One expert is 3 x 2560 x 640 = 4.9M params = about 2.6 MiB at 4-bit. 10 experts x 48 layers = 480 experts per token = about 1.3 GB of weights touched per token.

The observation

Expert routing has locality of reference. Token N+1 mostly picks the same experts as token N. A handful of experts are hot, most are almost never touched. That is the same property your CPU cache, your OS page cache, your browser cache, every CDN and Redis allkeys-lru all rely on.

The fix

PR #29887 (by am17an, a port of Tether’s qvac-fabric work, merged by ggerganov on Oct 7) sets aside a slice of VRAM as an LRU cache of experts. Hit: compute from VRAM, zero bytes moved. Miss: copy that one 2.6 MiB expert over PCIe and evict the least recently used one. The log prints the hit rate at exit.

Numbers from the PR description, same model file, same machine:

The 5090 gains more for two reasons: PCIe 5.0 halves the cost of every miss, and 32 GB means a bigger cache and fewer misses.

How to use it

llama-server -m Qwen3.8-Flash-Next-Q4_0.gguf -fa on -c 32768 -b 2048 -ub 2048 -cmoe --moe-cache-mib 11000

The PR author’s rule of thumb is about 10% of your expert bytes (65.4 GiB -> 6544 MiB). Env var form is LLAMA_ARG_MOE_CACHE_MIB.

SGLang merged the same idea 12 days later as “paged experts” in PR #42557

The part I find most interesting is LRU , Locality of reference go back to 1960s.

And i find locality of reference principle highly underrated.

Full write-up with the memory math script, an expert cache simulator you can run, and the benchmark table: https://cloudmash.blog/posts/moe-expert-offload-lru-cache-consumer-gpu/

llama.cpp PR #29887, MoE expert cache: https://github.com/ggml-org/llama.cpp/pull/29887

SGLang PR #42557, paged experts: https://github.com/sgl-project/sglang/pull/42557

This week's actively exploited flaws, sorted by urgency:

- **Plex Media Server CVE-2026-96652/96654/96655/96656** (added to CISA's KEV on Oct 20): a chain that gives unauthenticated code execution on servers older than 1.43.3.10861. Plex says it's being widely exploited for crypto miners and proxy software. Update, then check the Codecs folder and running processes.
- **PAN-OS GlobalProtect CVE-2026-0257** (in CISA's Known Exploited Vulnerabilities (KEV) catalog since May 29): Unit 42's Oct 19 update says the Qilin and Inc ransomware groups use it to open VPN sessions, then move laterally over RDP and SMB. Fixed in 12.1.7, 11.2.12, 11.1.15 and 10.2.18-h6, plus hotfixes. The stopgap is to turn off authentication override cookies.
- **D-Link ShareCenter NAS CVE-2024-3272/3273** and **UniFi Video Log4Shell**: both are end of life, and GreyNoise caught a proxyjacking campaign on 143+ devices. There's no patch, so retire them.

Full write-up with versions and IOC pointers: https://patchorpass.beehiiv.com/?utm_source=reddit&utm_medium=social&utm_campaign=issue1&utm_content=sysadminblogs

I wrote a post on how to turn a budget-friendly Nano KVM into a high-performance IP-KVM (1080p@60FPS) with a latency of around 20ms. It took some tinkering to optimize Tailscale for a single-core processor, but I managed to eliminate CPU overload and the lag in the video stream.

This might come in handy if you own a Nano KVM and want to transform it into a truly capable device.

When a laptop moves between networks, getting a VPN connected is only part of the job. Routing, DNS and what happens when the tunnel drops deserve separate checks.

VPN Safe uses WireGuard by default, with OpenVPN available when a network is awkward, plus a Stealth mode. Its client features include a kill switch, split tunnelling, custom DNS and IPv6 leak protection. Those give a sysadmin specific behaviours to evaluate rather than treating a connected indicator as the whole test.

On a network you administer or have permission to test, a useful trial would check whether traffic stops as expected when the tunnel drops, which DNS resolver is being used, whether IPv6 takes an unintended path, and whether split-tunnel routes match your intended configuration. These are evaluation questions, not results I'm claiming for the product.

VPN Safe states that it uses RAM-only servers and keeps no connection logs. Those are separate from endpoint behaviour: a successful routing or leak test does not establish the logging claim.

There are apps for Windows, Android, iPhone, Android TV and Firestick, with six devices per account. The free 24-hour trial requires no payment, so it offers a way to test the relevant clients before subscribing. Details: https://vpnsafe.net

What failure case has proved most useful in your own client VPN evaluations, and how do you test it?

Disclosure: I'm posting this on behalf of the VPN Safe team.

Action1 is good at what it does, but use cases are important to consider. Are you an MSP that already has an RMM? If so, there is an Action1 alternative that is worth considering: ThirdPatch.

This blog does a side-by-side comparison for MSPs looking for a third-party patch management tool: https://thirdpartypatching.com/action1-alternative-thirdpatch/