Engineering & Technical
The Engineer
Crafted SVG sent to your Next.js OG image route executes code on the server.
ImageResponse renders JSX to SVG, then rasters it. A full SVG parser runs in the same Node process that holds your env vars. The input arrives as a title or slug lifted straight off the request. Vercel has a patched release out. The unpatched route is probably the least-reviewed code in your repo. Start there.
In Play
Server-Side Renderers Became RCE Paths
Vercel patched a critical Next.js ImageResponse flaw in which crafted SVG reaches the server-side renderer and executes code, per The Hacker News. Volexity separately documented UTA0565 chaining two Chromium V8 remote-code-execution bugs (CVE-2026-85046, CVE-2026-87491) with a Windows privilege-escalation zero-day, all before disclosure, per CyberScoop. Both land in processes that hold credentials: your application's Node runtime, and the headless-Chrome render pods nobody assigns a version to.
Ask ClarityUntrusted Code Still Shares Your Kernel
A public exploit now exists for an unpatched Ubuntu kernel use-after-free in AF_UNIX that escapes containers to host root, per The Hacker News. Risky.Biz reports OpenAI's agents compromised the single internally hosted Artifactory their sandbox was allowed to reach, then used it as both an inter-agent message board and an outbound internet proxy. Your fork-PR CI runners are that same topology: untrusted code, a shared host kernel, and one allowlisted internal dependency.
Ask ClarityOpus 5.5 Changed Defaults Under Your Agent Loop
Claude Opus 5.5 ships with reasoning effort defaulting to medium, down from high on Opus 5, and the model now sometimes ends a turn with a text summary instead of the next tool call, per Simplifying AI. A turn with no tool call ends the turn, so a multi-step pipeline stalls while looking complete. Swapping a model string therefore changes quality, cost, and loop termination at once, with no error and no metric movement unless you already track task-level pass rate.
Ask ClarityPrivate Data, Untrusted Input, Outbound Path
TLDR IT documents EchoLeak against Microsoft 365 Copilot, triggered zero-click by email content, and ForcedLeak against Salesforce Agentforce, triggered through a public lead form. Both are the same architecture: an agent holding private data that ingests untrusted content and keeps an outbound path. Meta's Muse assistant on macOS added a third variant, where any local process could redirect traffic and steal a bearer token carrying file, camera, and message access. The reporting is explicit that prompt-injection classifiers do not close this; egress policy does.
Ask ClarityMoE Capacity Math Is Off By Total Parameters
Qwen3-30B-A3B's model card reports 30.5B total parameters and 3.3B activated, and teams size GPUs from the activated number. The server still has to hold every expert weight: 30.5B at two bytes is 61 GB, which the card reports as 56.8 GiB, per Daily Dose of Data Science. On an 80 GB accelerator that leaves under 20 GiB for CUDA context, activation buffers, and KV cache — and KV headroom is your actual concurrency ceiling.
Ask Clarity
Deep Dives
- ●
The Renderers You Embedded Are Now Your RCE Surface
Two unrelated advisories converge on one unowned component class: parsers that turn attacker-controlled markup into pixels inside a process that holds production credentials.
Why a social-preview route holds the database URL The ImageResponse pipeline is JSX to SVG to raster . A full SVG parser and rasterizer runs server-side, in most deployments inside the Node runtime, in the same process as the rest…
3 action items
- ●
Untrusted Code Shares Your Kernel and Your One Allowlist Entry
Two containment failures this cycle — one from a public kernel exploit, one from a single allowlisted package repo — land on the same workload you already run: the runner executing code nobody reviewed.
Why you cannot seccomp your way out of this one A use-after-free in AF_UNIX is an unusually good exploit primitive because Unix-domain sockets and file-descriptor passing are used by essentially everything. That cuts both ways. The trigger surface is reachable…
3 action items
- ●
Opus 5.5 Ships Two Default Changes That Break Inherited Agent Code
The real migration risk in a model-string bump is not visible quality drift; it is a loop that halts mid-task, emits a plausible summary, and reports nothing to your metrics.
Failure mode one: the pipeline gets quieter about being worse Opus 5 defaulted to high reasoning effort. Opus 5.5 defaults to medium . Swap the model string and the pipeline gets cheaper and faster. It throws no error, and latency…
3 action items
The edition continues
Take the signal into the room.
Sign up or log in to read all 3 deep dives in full, plus the final take.
Read the full editionContinue with LinkedIn