The Engineer

libssh2 is worse than a typical CVE because of transitive linkage. It compiles into curl for SCP/SFTP, Git for SSH transport, and PHP via the ssh2 extension. CI runners doing git clone over SSH are candidates. So are deploy scripts calling curl sftp:// and every base image still shipping old libssh2. The flaw fires before authentication, so credential hardening does nothing. With 130+ weaponized PoCs from the Exploitarium dump in the wild, the disclosure-to-exploitation gap is probably already closed.

Second, self-inflicted. npm 12 disables install scripts, git deps and remote-URL installs by default. npm install succeeds. package.json looks fine. But native addons — sharp, bcrypt, better-sqlite3, Prisma's postinstall generate — silently never compile. You find out at runtime, possibly in production. An explicit package.json allowlist is now required. Monorepos take a second hit: the 2FA changes make automated npm publish in CI ask for human approval, which breaks release automation.

Third, the direction supply-chain attacks are moving. The Injective Labs SDK compromise shipped 50K weekly downloads and stayed dormant until the app called wallet key-generation. Then it exfiltrated keys over HTTP POST. Static package analysis and postinstall inspection see nothing. Alibaba's XQUIC has a single-wrong-variable HTTP/3 DoS, XRING, that crashes servers with fully legal QUIC traffic. WAFs cannot see it. no patch available.

The through-line: install-time and static defenses no longer cover the threat. Behavioral triggers and transitive linkage walk right past them.

JADEPUFFER earns attention for its entry points: Langflow (CVE-2025-3248) and Nacos (CVE-2021-29441). Those are exactly the tools platform and data-science teams deploy with broad network access, weak auth, and no security review, because they're "internal." The attacker ran end-to-end extortion through an LLM and encrypted a production database. Langflow now carries a second active CVE (CVE-2026-55255, CVSS 8.4). It's an auth bypass. Any authenticated user can execute another user's flows. Fixed in 1.9.1, already exploited for credential harvesting.

GitLost is a different failure class. GitHub's AI issue-handler reads public issue titles as instructions while holding private-repo context. Crafted issues made the agent leak private contents. That's a confused deputy via prompt injection. The agent has no way to distinguish legitimate users from attackers.

Both sit on the identity gap. 69% of enterprises share credentials across agents and 54% have already had an incident. A shared key hands one prompt-injected agent the union of every permission it grants. Standard IAM models deterministic actors. An autonomous agent picking resources at runtime fits neither the human nor the service-account mold.

The synthesis is uncomfortable but simple. AI/ML tooling deserves the same posture as a public API gateway: network segmentation, patch cadence, per-invocation scoped identities. Not trust-by-default.

Speculative decoding has been the obvious lever since 2022. Production kept hitting the same wall. Sequential drafters like EAGLE-3 can't parallelize. Parallel drafters like DFlash throw away inter-token dependencies. DSpark uses DFlash as a parallel backbone plus a lightweight Markov correction head that recovers token-to-token dependencies in one sequential pass. The cost is 0.2-1.3% latency. Acceptance rates climb 27-31% over EAGLE-3 and 16-18% over DFlash across Qwen3-4B/8B/14B. I'd want to reproduce the acceptance numbers before trusting the top of that range, but the mechanism is sound.

The nonlinearity is the part that matters. At conservative per-user speeds (80 tok/s Flash, 35 tok/s Pro), DSpark yields ~51-52% total throughput gain. Real, not dramatic. At 120 tok/s Flash / 50 tok/s Pro, gains jump to 661% and 406%. So the value tracks your SLA target, not the technique in the abstract. Read the tok/s line in your config before you read the headline. Checkpoints are MIT-licensed on HuggingFace, and the gains hold on Gemma4-12B, which is a non-DeepSeek architecture. That's the evidence this transfers rather than overfitting one model family.

Set this against the rest of the inference stack. Unsloth's NVFP4 quants hit 17,561 tok/s on B200 and fit a 27B model in 24GB VRAM. Cohere open-sourced hardware-aware dynamic speculative decoding in vLLM, which removes the manual tuning loop. That tuning loop was the actual reason most teams left speculative decoding off in prod. If you wrote off self-hosting as too slow or too expensive a quarter ago, those numbers no longer hold. The counterweight, and it's the one today's contrarian raises, is that open-weight supply itself may be tightening.

Lighter's numbers are production-validated, not benchmarked in a lab. End-to-end p99 went from 280ms to 55ms. Transaction processing dropped from 20-30ms spikes to sub-1ms. On its busiest day it cleared 811 million transactions, 9,388 TPS average, 20,740 peak. The techniques layer and compose. None of them are crypto-specific.

Start at the foundation: allocation elimination. Swap big.Int/big.Rat for stack-allocated int128/float64. That removes the heap pressure that makes Go's GC unpredictable under load. Pair it with atomic immutable snapshots, copy-on-write state, and you kill allocation pressure and read-lock contention in the same move. GOGC tuning bought a 3x pause reduction. GOMEMLIMIT helps too. But both are cleanup. The lever is not allocating in the first place.

Then the OS layer. They measured a 10x cross-NUMA-node memory access penalty in production and consolidated onto single-NUMA-node machines. Add goroutine-to-thread pinning and SCHED_FIFO and hot-path apply dropped to 100-250 microseconds. Most teams on multi-socket servers eat this penalty and never see it. That includes most c5/m5-metal instances.

The idea worth stealing is architectural: decouple verification from the critical path. Lighter's sequencer handles proofs asynchronously. User-facing latency is bounded only by execution and API layers. The audit-logging, compliance, or fraud-detection step sitting synchronously on a response path is the same anti-pattern, and it is a candidate for the same treatment. Separately, etcd v3.7.0's RangeStream chunks large result sets instead of buffering them server-side. That removes a common control-plane OOM during cluster recovery.