The trouble this week came through credentials that were not where people look for them: the release process of an AI gateway, and a backup vendor holding rights inside other companies' Microsoft 365 tenants. Add a model whose open weights almost nobody can load at home, a study on what coding agents cost, and a DNS provider that leaves a whole country. Twelve of our posts go out with this edition, nine more were already online during the week. Where we read our own systems, the entry says what exactly we read. Everything else rests on the named sources and is marked verified (two independent sources read), vendor-claimed, or inferred (our reading).

Deep Dive: Credentials in the wrong hands

PyPI mark — PyPI is the package index that distributed the tampered LiteLLM 1.107.0. (Quelle: Simple Icons, file pypi.svg (CC0))

LiteLLM 1.107.0: malware on PyPI and Docker Hub

On 21 October, LiteLLM 1.107.0 was tampered with. According to LiteLLM the wheels were on PyPI from 11:39 to 13:23 UTC, and the Docker tags v1.107.0 and latest pointed to a malicious image from 11:46 UTC. The vendor puts the end at 14:20 UTC, Datadog at 13:53 UTC. The code runs on every Python process in the environment, even if LiteLLM is never imported, and reads cloud credentials, SSH keys and the provider keys stored in the proxy database. Deleting LiteLLM is therefore not enough, the environment has to be rebuilt. The last safe version is 1.106.2. It is the second LiteLLM incident this year, and Datadog sees no established link to the March one. The root cause (stolen GitHub tokens of maintainers) is the vendor's own account.

We read our two LiteLLM gateways on 24 October: both run pinned version tags (v1.100.4 and v1.106.1), both containers were started before the first upload, the indicator files /tmp/.pc_once_* and /tmp/remote_code_loader.lock are absent inside the containers, and there is no cook.pth or cook.py. The hosts' own /tmp was not part of the check. Result: checked, not affected. Timeline, check commands and the list of keys to rotate are in LiteLLM 1.107.0 was malware: if you pulled latest, rotate your keys.

ConnectWise Cloud Backup: app identities used against 2,250 tenants

ConnectWise reported unauthorised access to application identities of Cloud Backup (formerly SkyKick) on 16 October. On 21 October Microsoft attributed the attack to Storm-0940 and named the open-source pentest framework ARTEX. The 2,250 count tenants where sign-in attempts ran, and Microsoft says most of them failed. By 19 October Huntress counted follow-on activity in two tenants. The claim that attackers reached privileged access in under three hours in several cases comes from Microsoft alone. The checklist for logs and consents is in ConnectWise Cloud Backup: Stolen App Identities Used Against 2,250 M365 Tenants.

Assessment: In both cases the key sat in a supplier's process. Anyone running LiteLLM needs pinned tags or digests instead of latest, and an answer to what a gateway container may send out. Anyone who connects a backup or SaaS service to Microsoft 365 should list the service principals with Graph application permissions and read their sign-in logs and admin consents. Both come down to an inventory.

Deep Dive: Open models and what agents cost

Nemotron 3.5 comes from Nvidia, and our yardstick for Kimi K3.1 Pro is a server with Nvidia cards. (Quelle: Simple Icons, file nvidia.svg (CC0))

Kimi K3.1 Pro: 4th place, open weights announced

Moonshot AI presented Kimi K3.1 Pro on 23 October. Artificial Analysis measures 55 on its Intelligence Index, 4th place behind Opus 5.5 (58), with Sonnet 5.5 and Muse Wonder Full at 56 each. The model has 2.8 trillion parameters, 104 billion of them active, and the API costs 2 dollars per million input tokens and 10 dollars per million output tokens. Moonshot says it will publish the weights by 4 November, which is a vendor statement, and nothing had appeared by 24 October. The benchmark has a single measurer, because The Decoder takes its numbers from Artificial Analysis. The predecessor K3 comes to 1.56 terabytes of files. Our estimate for K3.1 Pro is similar (inferred): even at 4 bit it is about 1.4 terabytes, several times the memory of a server with four 32 GB cards. For trying it out, the API is the route. The calculation and the licence question are in Kimi K3.1 Pro: 4th in the AA Index, open weights announced, 2.8 trillion parameters.

Nemotron 3.5: Embed, Rerank and Parse for RAG

At GTC Berlin Nvidia (per The Register) presented three open model families for retrieval: Embed (1B and 8B, plus an NVFP4 build), Rerank 8B and Parse. They handle text and images in 34 languages. According to its model card Parse has about 0.63 billion parameters, while The Register says one billion. The licence is OpenMDW 1.1 rather than Apache. All benchmark figures come from Nvidia, including the claim that the reranker cuts token cost per agent query by 13 to 14 percent. We found no independent replication. Practical points: the card pins vLLM 0.32.0, the reranker is served through /classify, and a different embedder means different vector dimensions and a full re-embed. Details in Nemotron 3.5 Embed, Rerank, Parse: Nvidia's open RAG models from 1B.

Agent harness: up to three times the tokens at the same pass rate

Liu and Han (arXiv 2610.04433) compared five models across three harnesses (Claude Code, OpenCode, mini-SWE-agent) on SWE-bench Verified. Claude Code and mini-SWE-agent end up at most five points apart, while cost per task differs by up to a factor of three. The Decoder points to the preamble of system prompt and tool definitions that is resent at every step: about 16,600 tokens for Claude Code, about 7,000 for OpenCode, under 1,000 for mini-SWE-agent. Switching the harness flips the outcome on 13 percent of tasks, and so does simply rerunning the same harness. It is a preprint without peer review, and the per-step figures reach us through The Decoder. Another paper (arXiv 2607.22585) found up to 40-fold differences in a different setup. Context and a way to measure it yourself are in Study: the agent harness drives token costs up to 3x, the pass rate barely moves.

Assessment: All three items hang on numbers with one measurer or from the vendor. That is no reason to ignore them, but it is one to repeat them on your own material before deciding: Kimi through the API with your own tasks, Nemotron against your current embedder on your own collections, a harness with token counting per task.

Deep Dive: Network operations and the Linux desktop

Quad9 is the resolver leaving France. (Quelle: Wikimedia Commons, file Quad9 logo.svg, public domain (design by Erik Spiekermann for the Quad9 Foundation))

Quad9 leaves France

After a Paris ruling of 21 October in a case brought by beIN (tennis streams), Quad9 ends service for users in France on 24 November. The court sets a penalty of 1,000 euros per day, about 20 further proceedings are pending according to Quad9 and ComputerBase, and an appeal is under way. Quad9 says it keeps no user lists and cannot define a French user in any legally useful way, which is Quad9's own statement. Kuketz writes that Germany is not affected, and no source says anything about Austria, so we read it as unaffected (inferred). For your own resolvers: if Quad9 is the only upstream, look at the forwarder list and the SERVFAIL rate and add a second, independent upstream. The post: Quad9 leaves France: what it means for your DNS forwarders.

DietPi 10.8: WireGuard with a menu and a QR code

DietPi 10.8 of 21 October ships dietpi-wireguard: create servers and clients, show client configs as QR codes, change port, address and IPv6. The tool works with the existing files in /etc/wireguard but moves them to /etc/wireguard/clients/ when it changes them. That is in the script itself. Anyone with a hand-built config should back it up before the first run. See DietPi 10.8: WireGuard server and clients with QR code via dietpi-wireguard.

KeePassXC 2.8: Auto-Type on Wayland

KeePassXC 2.8.0 came out on 21 October. Auto-Type on Wayland runs through the XDG desktop portals, the move to Qt 6 is done, and the new Polkit feature for opening the database quickly adds a UUID to the database on first start and marks it as modified. Security fixes are included, among them CVE-2026-69150 in the importer for KeePass 1 files (CVSS 4.3, medium); the project rates the fixes low to moderate. More in KeePassXC 2.8: Wayland Auto-Type, database sync, Qt 6.

SteamOS 3.9.5: Linux 7.2, Plasma 6.7, one revoked CA

SteamOS 3.9.5 is stable: kernel 7.2, Plasma 6.7.3 in desktop mode, wpa_supplicant as the Wi-Fi default, and the revocation of compromised eMudhra CA certificates. The background is a Mozilla mail of 20 October: the private keys of eight eMudhra intermediate certificates are compromised. Browsers are covered through OneCRL and CRLSets, clients that do not check revocation are not. Details in SteamOS 3.9.5 is stable: Linux 7.2, Plasma 6.7, security updates.

Assessment: All four items concern small settings with big effects: a resolver's upstream, a config directory a tool touches, a database file that changes on update, and a certificate store. A backup and a look at the release notes before updating are worth the few minutes.

Deep Dive: Hardware and home

AMD mark — AMD makes the Radeon cards, the driver and FSR 4.1, which this block covers. (Quelle: Simple Icons, file amd.svg (CC0))

Olares One: 24 GB of VRAM instead of 32

The Olares One packs an RTX 5090 Mobile with 24 GB GDDR7, a Core Ultra 9 275HX and 96 GB DDR5 into a 3.5-litre case and runs Olares OS (open source, AGPL) instead of Windows. Caschy looked at it on 24 October, and his text is a first impression without measurements. We found no independent benchmark, and the price figures differ by source. The post works out (inferred) which models fit with their context into 24 GiB and where speed collapses once weights spill into system RAM: Olares One first look: AI mini PC with 24 GB VRAM, not 32.

FSR 4.1 on Radeon RX 6000

With Adrenalin 26.10.1 (AMD notes of 20 October) RDNA 2 gets FSR Upscaling 4.1 as well. On the RX 6950 XT ComputerBase measures a mean of 74.4 instead of 82.3 FPS at WQHD and 54.9 instead of 68.0 at UHD compared with FSR 3.1, so 10 and 19 percent less, with clearly better image quality. That RDNA 2 uses an INT8 variant is ComputerBase's assumption, AMD gives no details. The driver is Windows only, Vulkan is to follow later. Numbers and open points: FSR 4.1 on Radeon RX 6000: tested on RDNA 2 with INT8.

tado: AI window detection, heating pause stays in the subscription

tado announces room-specific learning for open-window detection next month, plus a mould index. The automatic heating pause stays in the subscription (ComputerBase lists 3.99 euros a month or 29.99 a year), and without it there is only a push notification. heise and ComputerBase both rest on the same announcement, the improvement is a vendor claim, and heise writes that detection did not always trigger in its tests so far. A contact sensor with a Home Assistant automation needs no subscription. Comparison and sources: tado open window detection gets AI, the automatic heating pause stays behind a subscription.

Assessment: For all three products the main claim lacks an independent measurement: the Olares One's speed, tado's quality gain, FSR 4.1 image quality, where only ComputerBase's image comparisons exist. Until then the figures count as vendor or single-source measurements.

Digest: Other important news

Label at the end of each line: verified (two sources read), reported (one source read), vendor-claimed (the figure comes from the vendor).

Security

GitLab: CVSS 10.0 reaching back to version 7.0 CVE-2026-110264, an integer overflow while compiling a crafted regular expression. Self-managed CE and EE are affected, unauthenticated under certain conditions, fixed in 19.5.1, 19.4.3 and 19.3.6 and in backports down to 18.11.13. GitLab.com is already patched, and no exploitation is known. It is a different bug from last week's. | reported
Pi-hole FTL 6.8, Web 6.6.1, Core 6.5 Five high-rated flaws (CVSS 7.3 to 7.8, GitHub advisories without CVE numbers): command execution via manipulated process IDs, root-level writes to configurable paths, unsafe symlinks and privilege escalation via CAP_CHOWN. Also access to password hashes and TOTP secrets through restricted API sessions. The releases came out on 17 October. | reported
GitHub Package Firewall for npm The preview for GitHub Enterprise Cloud filters package requests by policy: a waiting period for new versions, blocking of known malware, blocking of new install scripts and of missing SLSA provenance. npm only, free during the preview, no later pricing stated. | reported
Chrome 155 asks before unencrypted connections "Always use secure connections" is on for all desktop and Android users. Chrome asks on the first visit and again after a two-week gap. Single-label hostnames and local IP addresses are exempt. The report does not say how administrators control it. | reported

Hardware

Qotom Q51551UT reviewed Mini PC with a Core Ultra 5 125H, six 2.5GbE ports (I226-V), two 10GbE RJ45 (X540) and two 10GbE SFP+ (X710), tested with 96 GB DDR5. The test ran on Ubuntu 26.04 LTS, and the part we read gives no price and no noise or power figures. | reported

AI and development

Cloudflare Clairic: reading fields in one pass Clairic extracts given fields (order number, amount) from text and returns a value with a confidence score per field, in preview on Workers AI. An example chain with Clef and GLM-5.3 takes 19.3 seconds according to Cloudflare, GLM-5.3 alone 61.7 seconds. Open weights are to follow "soon", with no date and no licence stated. | vendor-claimed
Four Gemini 4 agents beat Minecraft in 27 hours According to Google's paper, four agents needed 27.23 hours to reach the Ender Dragon, with 605 deaths, 2,783 programs written and 1.35 billion input tokens. They worked through chat and shared memory using the Mineflayer library, without human-written Minecraft tools. It demonstrates coordination and measures nothing else. | vendor-claimed
OpenCode 2.1 Persistent terminals on Windows, an experimental task list, and no more dropped connections on commands over five minutes. SDK, API and plugin integrations get breaking changes: provider data moves under tool.native, session.compacted is removed. | reported

Consumer hardware

GeForce 621.01: Nvidia confirms black screens and video freezes Since the driver of 21 October, videos freeze in Chrome, Edge and sometimes VLC and monitors go black briefly, with many reports on the RTX 5080. Nvidia has filed a bug and is collecting crash dumps. Users report relief after going back to 617.42 of 6 October, and there is no date for a fixed driver. | reported
Windows 11 "up to 20 percent more responsive" Microsoft compares build 26200.7628 from January with 26300.9550 from September (Start, Explorer, search, Snipping Tool, Microsoft 365, Edge). The test method is unpublished and ComputerBase did not verify the figure. On devices with 8 GB RAM, widgets are to load only when opened. | vendor-claimed
Microsoft Authenticator: new home page, changes to cloud backup From January 2027 the Android app backs up through Google One, and a personal Microsoft account and OneDrive drop out. iOS already gets the new interface, Android follows in November. Microsoft advises preparing the help desk and guides (MC1521604). | reported

Software releases

Fedora 45 slips a second time The Go/No-Go of 22 October failed on open blockers, among them an eMudhra update and LVM problems after upgrading LUKS systems. The new date is 3 November, depending on the blockers. linuxnews.de reports the same second delay. | verified
Multipass 1.17 Debian and Fedora are officially supported as guests, VMs can be grouped into availability zones with their own network, and multipass wait-ready helps in scripts. The LXD and libvirt drivers were removed. | reported
Windows Server 2025: Quick Machine Recovery With the October update a server that fails to boot starts into the recovery environment and fetches fixes through Windows Update. Cloud remediation is off by default and is switched on by group policy under Computer Configuration, Administrative Templates, System, Quick Machine Recovery. | reported
Factorio 2.1 The clean-up update brings a native ARM64 build for Linux, meant among other things for Raspberry Pi as a headless server. The source did not measure performance on the Pi. | reported
Linux 7.4: workqueue flush up to 100 times faster In the merge window a flush checks only the queues used since the previous flush. Phoronix quotes idle flushes 10 to 100 times faster on large systems, relevant for XFS log forces, for instance. The figure comes from the pull request. | reported

Smart home

Home Assistant: installer builds a bootable USB stick The official installer (0.0.0-alpha.4 of 23 October) creates a stick or an ISO that installs Home Assistant OS onto an x86-64 mini PC, for fresh installs only. It is an alpha and belongs on a spare machine for testing. | reported
LocalDot: Echo Dot 3 as a Home Assistant speaker A replacement board (ESP32-P4 for audio, ESP32-S3 for Wi-Fi) replaces the main board, and the four microphones stay. Price and ship date are not announced, and features such as timers are only planned. | reported

Videos of the week

Plain links. We did not watch every video in full, so the notes follow title, channel and video description.

CRN: ConnectWise Cloud Backup Breach: What MSPs Need To Know Five minutes on scope and the reactions of ConnectWise and Microsoft, a useful primer for customers asking about the incident.
Arena: Kimi K3.1 Pro First Impressions: Has Moonshot Caught Up to the Frontier? A first impression of about 42 minutes. It measures nothing, and we take no numbers from it.
Techlore: Why DNS Privacy Matters More Than You Think (Quad9 Interview) Interview with Quad9's CTO from September, before the Paris ruling; it explains DNS privacy and never mentions the case.
AMD Gaming: AMD FSR Upscaling 4.1 for Desktop, Laptop, Handheld and Console Official announcement video of 20 October, vendor material without independent measurements.

From the blog

Twelve new posts with this edition:

Nine posts that went online earlier in the week:

Sources for this edition

Deep dive credentials: LiteLLM incident report, Datadog Security Labs on LiteLLM, The Register on LiteLLM, heise on ConnectWise, The Register on ConnectWise, Microsoft on Storm-0940
Deep dive open models and agents: The Decoder on Kimi K3.1 Pro, Artificial Analysis on Kimi K3.1 Pro, The Register on Nemotron 3.5, arXiv 2610.04433, The Decoder on the harness study
Deep dive network operations and Linux desktop: heise on Quad9, Quad9 announcement, Kuketz on Quad9, DietPi 10.8, KeePassXC 2.8.0, Valve on SteamOS 3.9.5, Mozilla on eMudhra
Deep dive hardware and home: Caschy on the Olares One, AMD, Adrenalin 26.10.1, ComputerBase on FSR 4.1, heise on tado, ComputerBase on tado
Digest: The Register on GitLab, linuxnews.de on Pi-hole, heise on the Package Firewall, heise on Chrome 155, ServeTheHome on Qotom, The Decoder on Clairic, ComputerBase on Gemini 4 in Minecraft, heise on OpenCode 2.1, ComputerBase on GeForce 621.01, ComputerBase on Windows 11, heise on the Authenticator, Phoronix on Fedora 45, linuxnews.de on Fedora 45, linuxnews.de on Multipass, BleepingComputer on Quick Machine Recovery, GamingOnLinux on Factorio 2.1, Phoronix on Linux 7.4, smarthomeassistent.de on the HA installer, smarthomeassistent.de on LocalDot
Videos of the week: CRN, Arena, Techlore, AMD Gaming
Logos (CC0 or public domain): Simple Icons, PyPI, Simple Icons, Nvidia, Wikimedia Commons, Quad9, Simple Icons, AMD

Compiled on Saturday, 24 October 2026. Sources: see above. Anything that arrives afterwards goes into the next edition.

IT News Week 44/2026: LiteLLM malware, ConnectWise breach, Kimi K3.1 Pro, Quad9 leaves France