helix (@helixml) header
helix (@helixml) profile picture

helix

@helixml

Self-hosted coding harness multiplexer, sandboxes, bots, model proxy

 Inside the internet
helix.ml
Joined October 2021
  • Tweets74
  • Following4
  • Followers142
19Media
Photo by helix (@helixml)Photo by helix (@helixml)Photo by helix (@helixml)Photo by helix (@helixml)Photo by helix (@helixml)Photo by helix (@helixml)Photo by helix (@helixml)Photo by helix (@helixml)Photo by helix (@helixml)Photo by helix (@helixml)
Pinned Tweet
helix (@helixml) profile picture
helix
@helixml18h
cyber security space rn
Image from helix (@helixml)
1
1
18
CISA added the Brotli decoder bug CVE-2026-111497 (CVSS 9.2) to KEV; ELLIO has recorded exploit traffic. Node.js, Bun, .NET, Python, Envoy and Istio embed the vulnerable decoder. Update runtimes: Node 22.23.4 / 24.22.1 / 26.12.1. helix.ml/threat-watch/i/io-c…
Node2Shell: Brotli decoder OOB write across Node.js, Python, Bun, .NET, Java… | Threat Watch

Node2Shell: Brotli decoder OOB write across Node.js, Python, Bun, .NET, Java… | Threat Watch

Critical · CVSS v4.0 9.2 Critical (Node.js rates High); confirmed in-the-wild exploitation and listed in CISA KEV as of 2026-10-29; public PoC since…

helix.ml
1
56
Also fixed: .NET 8.0.33/9.0.22/10.0.14, Bun 1.4.4, Python Brotli 1.2.1. EOL Node.js lines (20.x, 23.x, 25.x) get no fix. Public PoC since Oct 22; Imperva showed RCE on Node 24.22.0 arm64 after several attempts.
15
Cisco Talos: UAT-11473 exploited Catalyst SD-WAN auth bypass CVE-2026-20127 (CVSS 10) to deploy KeyDrift, malware that harvests AES-256 keys used between SD-WAN routers. Targets: space, defense, policy research. Patch, but hunt for implants first. helix.ml/threat-watch/i/keyd…
KeyDrift / UAT-11473: Cisco Catalyst SD-WAN — attackers exploited auth-bypass flaw to… | Threat...

KeyDrift / UAT-11473: Cisco Catalyst SD-WAN — attackers exploited auth-bypass flaw to… | Threat...

Critical · CVSS 10.0 auth bypass; confirmed in-the-wild exploitation by Volt Typhoon-linked actors since at least late 2025; targets include space/satellite…

helix.ml
2
51
Components: LittleFilch (key harvesting) and PolyFlame (in-memory backdoor inside vdaemon). Fixed releases: 20.9.8.2, 20.12.6.1, 20.15.4.2, 20.18.2.1. Stopgap: limit ports 22/830 to known controller IPs.
5
helix retweeted
helix (@helixml) profile picture
helix
@helixml18h
cyber security space rn
Image from helix (@helixml)
1
1
18
helix retweeted
helix (@helixml) profile picture
helix
@helixmlOct 28
Lumen: China's Volt Typhoon used its 'Silent Train' relay network to exploit 4 zero-days in Versa Director, N-central, Cisco SD-WAN and VeloCloud Orchestrator. Hundreds of victims notified. Patch, pull mgmt planes off the internet, hunt for access. helix.ml/threat-watch/i/sile…
Volt Typhoon 'Silent Train': rotating relay chains used to exploit zero-days in SD-WAN… | Threat...

Volt Typhoon 'Silent Train': rotating relay chains used to exploit zero-days in SD-WAN… | Threat...

Critical · CVSS up to 10.0 · four KEV-listed zero-days in management/control planes · nation-state, hundreds of US critical-infrastructure victims notified…

helix.ml
1
1
3
47
Lumen: China's Volt Typhoon used its 'Silent Train' relay network to exploit 4 zero-days in Versa Director, N-central, Cisco SD-WAN and VeloCloud Orchestrator. Hundreds of victims notified. Patch, pull mgmt planes off the internet, hunt for access. helix.ml/threat-watch/i/sile…
Volt Typhoon 'Silent Train': rotating relay chains used to exploit zero-days in SD-WAN… | Threat...

Volt Typhoon 'Silent Train': rotating relay chains used to exploit zero-days in SD-WAN… | Threat...

Critical · CVSS up to 10.0 · four KEV-listed zero-days in management/control planes · nation-state, hundreds of US critical-infrastructure victims notified…

helix.ml
1
1
3
47
Fixed builds: VeloCloud Orchestrator 5.2.3.14/6.1.3.4/6.4.2.4/7.0.0.1 (CVE-2026-16812), Cisco SD-WAN CVE-2026-20127, N-central 2025.3.1 (CVE-2025-8875/8876), Versa Director 22.1.4 (CVE-2024-39717). Patching won't evict an actor already inside.
1
101
9% faster GLM-5.3-Flash prefill with GPU-to-GPU IPC Interestingly we have seen similar patch to SGLang recently but in that PR it's not even enabled as they tried on different hw/config and didn't see the gains. It makes sense to try things on your own hardware!
Image from helix (@helixml)
1
3
56
Ref: helix.ml/blog/glm53-flash-tp… PR with similar code: github.com/sgl-project/sglan… They tried on 8GPU node with 2x TP4 engines, at that point it doesn't give much perf boost. But if you have 2xTP2 or 4xTP2 - different situation.

Faster GLM-5.3-Flash Prefill on RTX PRO 6000: TileLang, PCIe All-Reduce and Memory Placement —...

We profiled GLM-5.3-Flash on two RTX PRO 6000 GPUs. A TileLang kernel ran 2x faster in isolation and changed nothing in production. A chunked PCIe all-reduce made prompt reading 9% faster, and a...

helix.ml
2
143
fuck, the board will be hearing about this!
Luke Marsden (@lmarsden) profile pictureLuke Marsden
@lmarsdenOct 26
leaked internal video
14
helix retweeted
helix (@helixml) profile picture
helix
@helixmlOct 26
9% faster GLM-5.3-Flash prefill with GPU-to-GPU IPC Ref: helix.ml/blog/glm53-flash-tp…
Image from helix (@helixml)
1
1
77
9% faster GLM-5.3-Flash prefill with GPU-to-GPU IPC Ref: helix.ml/blog/glm53-flash-tp…
Image from helix (@helixml)
1
1
77
helix retweeted
helix (@helixml) profile picture
helix
@helixmlOct 26
We have entered cyber apocalypse. Threat Watch: helix.ml/threat-watch 🚨 Helix Cyber: helix.ml/cyber for relentless blue/red team pen-test on your applications and infra review 🛡️
Image from helix (@helixml)
1
1
92
We have entered cyber apocalypse. Threat Watch: helix.ml/threat-watch 🚨 Helix Cyber: helix.ml/cyber for relentless blue/red team pen-test on your applications and infra review 🛡️
Image from helix (@helixml)
1
1
92
a small guide for ppl deciding what kind of router to put in from of your gpu nodes - helix.ml/blog/ramjet-vs-nvid… things change ofc when you go with more and more nodes
Image from helix (@helixml)
3
65
helix retweeted
helix (@helixml) profile picture
helix
@helixmlSep 26
In this case we were looking why our glm-5.3 flash had the slow hiccups even though long prompts were perfectly aligned. Full writeup helix.ml/blog/glm53-flash-hy… , you can just give it to your agent to check your inference engine

GLM-5.3-Flash Prefix Caching: Why KV Cache Size Is Not Enough on Hybrid Attention — HelixML

Our GLM-5.3-Flash replicas kept forgetting cached prompts while their 500,000-token KV cache sat mostly empty. On a hybrid linear-attention model the limit was 28 state snapshots. Here is how we...

helix.ml
1
1
26
helix retweeted
helix (@helixml) profile picture
helix
@helixmlSep 26
so, you have enough kv cache space but your sessions get evicted? check your settings around attention layers
Image from helix (@helixml)
1
1
3
28
so, you have enough kv cache space but your sessions get evicted? check your settings around attention layers
Image from helix (@helixml)
1
1
3
28
In this case we were looking why our glm-5.3 flash had the slow hiccups even though long prompts were perfectly aligned. Full writeup helix.ml/blog/glm53-flash-hy… , you can just give it to your agent to check your inference engine

GLM-5.3-Flash Prefix Caching: Why KV Cache Size Is Not Enough on Hybrid Attention — HelixML

Our GLM-5.3-Flash replicas kept forgetting cached prompts while their 500,000-token KV cache sat mostly empty. On a hybrid linear-attention model the limit was 28 state snapshots. Here is how we...

helix.ml
1
1
26
Load more