The Bug That Runs Before Your Operating System

Today is Wednesday, October twenty-eighth, twenty twenty-six, and welcome to The Daily Reboot.

Here's what happened in tech on Tuesday.

A sixteen-year-old buffer overflow that runs before your operating system wakes up, a small model built to call your tools, and Discord putting public server messages into web search.

Let's get into it.

Five hundred four bytes. That's one fixed buffer in some firmware, and it's today's number to remember.

TianoCore published an advisory for EDK II, the open-source UEFI code that Ars Technica says AMI, Insyde, and Phoenix build on. The bug sits in the PXE Base Code driver, which handles network boot.

During network boot, that driver leaves an ICMP receive request open. An unauthenticated attacker who delivers an oversized ICMP error overflows the buffer. Per the advisory, the IPv4 and IPv6 handlers both mishandle bounds, advancing the destination pointer by cumulative length instead of per-fragment length.

The mild outcome is a hung boot. The worse one, per the advisory, is that an attacker who knows the target's firmware build can dispatch their own code in the DXE phase, using a counterfeit event. That's before the operating system loads, so none of your OS defenses exist yet.

HD Moore of Dragos told Ars the bug could let a nearby attacker hijack program flow while boot can still reach the TPM.

Now the catch. Ars reports a severity of nine point five out of ten. NIST lists affected versions through EDK two stable twenty twenty-six oh eight, but says it hasn't supplied its own score. So that number belongs to the reporting, not NIST.

It's also not one universal exploit. Exposure depends on the vendor's implementation and whether PXE boot is on. The attacker must reach the machine during its PXE window, and needs details specific to that firmware. Vendors will stress that. Defenders will say firmware patching is slow.

Ars calls it a sixteen-year-old overflow in a boot protocol. Old enough for a learner's permit, and still driving unsupervised.

Which vendors are affected, and when tested updates land, is still unclear. So list which of your machines PXE boot at all, then watch for your vendor's advisory.

Firmware is code you never chose. The next story is a model you pick, download, and run yourself.

Somebody had to read the Enron archive. Liquid says it ran more than three hundred thousand LFM three agents in parallel to do it.

Liquid announced six open-weight, roughly two-billion-class models. Text, vision, audio, omni, and two decision models. The text one, LFM three one point seven B, states a two hundred fifty-six thousand token context, input and output combined.

For callers, tool use is the news. You pass function schemas through the chat template, and the model hands back calls as XML. Your app runs the call, returns the result, and sends the schemas again on later requests.

Under the hood, it's twenty-four layers. Thirteen are gated short convolutions, five are sliding-window attention, and only six are global attention.

The number is WebArena-Verified. Liquid reports thirty-eight point four two, against three point oh two for its predecessor and twenty-eight point nine four for Qwen three point five nine B. Those are Liquid's own runs, and VentureBeat says Liquid didn't directly address whether every comparison used equivalent tools.

VentureBeat reports the console lists eight cents per million input tokens, twenty cents output, and two cents cached. It shows a hundred twenty-eight thousand token limit, not two hundred fifty-six. Maximum output is unknown.

Open weights are free for production under ten million dollars in annual revenue. Ollama support starts on Apple hardware.

The model card says it isn't recommended for agentic coding or complex multi-step reasoning. Liquid itself says larger models still win there.

Verdict. Try it on a narrow local agent, extraction, or classification job. Run pip install with transformers and accelerate, then load the Liquid AI LFM three one point seven B repo with trust remote code on. Coding agents, wait, and test your own tasks first.

Those tool calls come back as XML your app must parse. Parsing is where Astral just spent serious effort, on a format that looks simple until two parsers disagree.

Astral notes a one-byte file in a tar archive can waste one thousand twenty-three bytes. The padding can even hold lines from the Bee Movie.

That's the format Astral just rebuilt. Their Rust parser, tar-codec, has handled source distributions in uv since uv zero point thirteen, and Astral measures it at roughly twice the speed of the old astral-tokio-tar.

Speed isn't the pitch. Security reports showed parser differentials, where uv, pip, and other tools read one tarball differently. Astral says the old tokio-tar family was too lenient by design.

The parser classifies the archive family from the first block and stays in it, so GNU and pax extension states never get merged. Mixed headers are rejected. Extraction uses cap-std to anchor every filesystem write to a chosen directory.

The honest limit is in the repo, which calls astral-codec early-stage and not ready for production, though uv already uses tar-codec. The speedup and security benefit are Astral's own claims, and no independent benchmark or audit was read.

To try it, run cargo add tar-codec. It's Apache two point oh and MIT licensed.

Tar's trouble is two readers seeing the same bytes differently. Discord is about to hand its messages to a lot more readers.

More than sixty-three thousand Discoverable Servers on Discord get their own web page starting November sixteenth.

Eligible servers need at least a thousand members and eight weeks of age. Pages may carry automated summaries of active public channels.

The bigger change lands in mid-December. Selected public-channel messages may start appearing on those pages and in web search. Admins choose channels under Server Settings, Web Presence. Members get a separate Data and Privacy switch. Usernames and avatars won't appear, and messages posted before the rollout are excluded.

Member opt-in is off by default in the EU, UK, Canada, Brazil, Australia, and South Korea, and teens can't enable it. Private servers and DMs are out.

Here's the catch. Channel summaries are separate from messages. They draw on broader topics and stay visible unless admins disable them, even if a member opts out of message display.

TechCrunch reports users worry about messages surfacing out of context, and about AI training. Discord's announcement describes pages and search, not a new AI-training policy.

Discord says Server Discovery was built for finding servers, not answers. Its pilot covered NBA two K, Rust, and Dead by Daylight communities, and every post came from admins and moderators.

How deletion and cached search results will work is still unclear. If you run a project community there, check Web Presence before November sixteenth, and again in mid-December.

Discord is turning real conversations into pages. DeepMind is generating a whole world from words, and the question is how much of it holds still.

DeepMind's launch examples include a stained-glass landscape, a first-person dragon race, and a crowded nineteen eighties Japanese station scene. Demos, not proof it obeys every prompt.

Genie four is a real-time interactive world model with native audio. You steer it in natural language while it runs, changing the weather, moving the camera, or adding a person or object.

The mechanism is a hybrid. Genie generates the immediate world state, while Gemini three point eight Flash sits in the loop as a guiding agent, checking frames and adapting plans as things change.

TechCrunch reports scenes stay consistent for up to two minutes, double the predecessor. DeepMind's post doesn't state that figure, so treat it as TechCrunch's.

DeepMind says object permanence and visual detail can drift, and physics, legible text, and long-term consistency remain open problems. Generated audio and video will carry SynthID watermarking.

You can't call it yet. It's a research preview for trusted testers. DeepMind plans access for Google AI Ultra subscribers in Project Genie, and for early-access partners through the Gemini API.

Verdict: watch, don't build. Believable isn't the same as physically reliable, and DeepMind's own limits list says so.

Genie is limited to trusted testers. The next three tools are live, and each is about who acts and who gets the bill.

GitHub Copilot SDK server-to-server authentication, public preview. Your Copilot automation can stop borrowing a human's login. Install a GitHub App on the organization, grant read-only Copilot Requests permission, and pass the SDK a short-lived installation token. Usage is billed to the organization, and its model policies and budgets apply. Platform teams should try it, once security checks the token lifecycle.

Claude Code two point one point three one two. The apps gateway gets an oidc user ID claim setting, so operators can identify users by a claim other than sub, like Microsoft Entra ID's oid. If your identity provider's stable identifier isn't sub, upgrade. The same release stops Claude Code overwriting a huge rules file after reading only the beginning, which is how most of us skim config anyway.

Codex CLI zero point one six five point zero. There's now a built-in Google Cloud Vertex AI provider. Set model provider to gcp in your config and Codex routes through Vertex. If your cloud bill already lives at Google, update.

Billing is simple when the unit is a token. The next item sells whole accelerators, years from now.

Oracle and Google say Google TPUs are coming to Oracle Cloud Infrastructure, which Oracle calls the first hyperscale cloud outside Google to offer them. Availability starts in twenty twenty-seven and ramps over several years, with no quantity or customer pricing given.

Oracle says TPU eight t, the training chip, delivers nearly three times the compute per pod of the prior generation. That's a company claim, not an OCI benchmark.

The Register reports the TPUs arrive alongside new Nvidia hardware, not instead of it. For you, that's another architecture option someday, with no price or compatibility data to plan around today.

Those chips arrive in twenty twenty-seven. These next stories arrived yesterday, uninvited.

Fast Boot, four items, zero staging environments.

Tailscale SSH. Tailscale is investigating multiple SSH issues, the most concerning involving privilege escalation by someone already authorized, and targeted a patched client by the end of Tuesday. That date came with a subject-to-testing clause, so even the deadline had a dependency.

Cipher. Causal Security says its agent Cipher found four EPICS Base vulnerabilities in three hours and forty-nine minutes, one rated nine point eight. The company calls Cipher a fully autonomous super hacker, a title so far confirmed only by the company.

Aokigahara. Check Point found a Windows infostealer, Aokigahara, that collects session and authentication files for Claude, Codex, Cursor, and Copilot, plus Git, SSH, and cloud credentials. It's named for what Dark Reading calls a haunted forest, heavy theater for a config file reader.

Forty-four agents. TrendAI described CyberStrikeAI splitting a Japan-targeted attack across forty-four agents, from reconnaissance to exfiltration, and it generated Japanese-language fake login pages. Even the phishing got localization, so the attackers' i18n is in better shape than most backlogs.

Forty-four agents, one company-branded super hacker, and per TrendAI the work still consists of looking for unlocked doors. So lock a few before you test in production.

Today we covered the EDK II PXE flaw, Liquid's LFM three models, Astral's tar-codec, Discord's searchable servers, and Genie four.

Your try-it for today. Tailscale isn't telling everyone to turn SSH off. But if you use Tailscale SSH and don't need forwarding, set `TS_SSH_DISABLE_FORWARDING=1` in the tailscaled service environment and restart it.

Sources are in the show notes. Follow The Daily Reboot wherever you get your podcasts.

Thanks for listening. See you tomorrow.