vLLM's unauthenticated DoS surface, and a 1.9x SYCL MXFP4 lift

Unvalidated stop_token_ids causes engine crash (DoS) and out-of-bounds GPU write vllm-project/vllm

Unvalidated stop_token_ids crashes the engine (DoS) and writes out of bounds on the GPU. Multiple vLLM reports landed at once: a frame-count cap bypass in VideoMediaIO.load_base64 for video/jpeg via media_io_kwargs.video.num_frames, a remote DoS in the disaggregated multimodal /inference/v1/generate path through malicious kwargs_data and mm_placeholders, and Nemotron-VL processors disabling Pil...

SSRF via X-Request-Id header drives P2pNcclConnector outbound ZMQ+NCCL pair, leaking KV-cache tensors vllm-project/vllm

An SSRF through the X-Request-Id header drives the P2pNcclConnector's outbound ZMQ+NCCL pair and leaks KV-cache tensors. That one crosses tenant boundaries rather than just taking the server down, which puts it at the top of the queue for anyone running P2P NCCL disaggregation.

sycl : accelerate MXFP4 MoE with arithmetic decoding and weight reordering ggml-org/llama.cpp

by Captain-Tripps

The SYCL backend now decodes MXFP4 MoE bit-identically in 32-bit arithmetic instead of table-based decoding with permute emulation, plus lazy per-expert weight reordering. Reported gains are 55.84 to 106.64 tok/s on gpt-oss-20b (1.91x) and 33.27 to 67.14 tok/s on gpt-oss-120b across two cards (2.02x), with perplexity effectively unchanged at 14.5148 to 14.5129.

[Scheduler] Fix the deterministic-inference hang when a prefill chunk is shorter than its alignment sgl-project/sglang

by hnyls2002

Deterministic inference truncated each prefill chunk to a multiple of the 4096 alignment, so a per-rank chunk below that, from --chunked-prefill-size or DP attention splitting across ranks, truncated every chunk to zero tokens and left prompts longer than the chunk queued forever. The fix drops the alignment; Triton instead pads each sliding-window KV list to an absolute multiple of 128 via ali...

Add FloorDivide primitive for integer floor division ml-explore/mlx

by CodeAndCanvas728

Integer x // y had expanded into a 7-op sub-graph since the earlier refactor, and on large graphs that overhead produced Metal GPU timeouts. A dedicated FloorDivide primitive compiles it to a single fusable binary op across CPU, Metal, and CUDA.

Add stft and istft to mlx.core.fft ml-explore/mlx

by eyupcanakman

Also new in mlx.core.fft: stft and istft, implemented in C++ so every language binding gets them, framing the last axis with as_strided and following torch.stft's signature except for the "backward"/"ortho"/"forward" norm strings. In the long tail, ollama skips its local model compatibility migration because it added per-request overhead and GC pressure for high-volume workloads like embeddings...