Baseten vs Red Hat

Baseten, Hugging Face, Goodfire Partner for AI Safety

Baseten's research arm, Base Labs, announced a partnership with Hugging Face and Goodfire AI to establish a safety standard for open-weight AI models. The collaboration aims to develop and publish methods for training and monitoring these models, making safety an integrated feature rather than an afterthought. This comes amid rising concern over 'abliteration,' a technique that removes safeguards from open models, with Hugging Face listing over 6,000 such models. The companies have not detailed technical specifics, but Goodfire's expertise in AI interpretability is expected to play a key role. This initiative seeks to leverage openness as an advantage for safety, providing transparent controls and encouraging community contributions.

• Baseten launched a safety infrastructure standard via Base Labs.
• Partnership with Hugging Face and Goodfire AI announced.
• Hugging Face hosts over 6,000 abliterated models.

Blaxel is joining Baseten to build the future of agentic infrastructure

Baseten announces that Blaxel is joining the company to build the future of agentic cloud infrastructure. The blog post highlights this strategic move, which is a major corporate announcement.

DeepSeek Launches V4.1 Flash with Novel Encoder-Decoder Architecture

DeepSeek released DeepSeek-V4.1-Flash, a 763B-parameter mixture-of-experts model employing a novel causal encoder-decoder architecture with 8B active parameters for prefill and 16B for decode. It features native vision understanding, 1M token context, an MIT license, and extreme inference efficiency, claiming up to 1/8 KV cache footprint versus V4 Flash. Independent evals (Artificial Analysis Index 40, Vals Index #1 open-weight) show it surpasses V4 Pro at lower cost. API pricing is $0.30/1M input and $1.20/1M output tokens. DeepSeek has soft-retired V4 Pro, routing traffic to V4.1 Flash. The model supports SSD offload and local deployment, with Ollama and Baseten offering day-0 support. Technical discussions highlight the architecture's novelty and potential impact on long-context agents.

• DeepSeek launched V4.1-Flash with a causal encoder-decoder architecture, 763B total params (8B prefill/16B decode active).
• Artificial Analysis Index scores V4.1-Flash at 40, above V4 Pro and below GLM-5.3-Flash.
• API pricing: $0.30 per 1M input tokens, $1.20 per 1M output tokens, cached input $0.006 per 1M.

CISA flags three actively exploited Linux kernel flaws

The US Cybersecurity and Infrastructure Security Agency (CISA) has added three Linux kernel vulnerabilities to its Known Exploited Vulnerabilities Catalog (KEV), indicating they are being actively exploited. The flaws, tracked as CVE-2025-39682, CVE-2026-53266, and CVE-2025-39964, are rated as 'critical' or 'high' severity. Red Hat has confirmed exploitation via publicly known exploits. The vulnerabilities can lead to system crashes, privilege escalation, and remote code execution. CISA has ordered US federal agencies to patch affected systems within three days or temporarily take them offline. Patches are available in the kernel, and administrators are urged to apply them urgently. No details on the threat actors or targets have been disclosed yet.

• CISA added three Linux kernel vulnerabilities to its KEV catalog: CVE-2025-39682, CVE-2026-53266, and CVE-2025-39964.
• Red Hat confirmed that all three vulnerabilities are exploited in real attacks via publicly known exploits.
• CVE-2025-39682 involves an error in processing empty TLS records in kernel TLS, potentially leading to system crashes and code injection.

Tokens-per-Second Benchmarks Explained

This technical guide explains what "tokens per second" (tok/s) actually measures for local LLM inference, why single-user tok/s numbers can be misleading, and how concurrency, batching, and prompt processing change the observed speed. It contrasts single-user latency with server throughput, highlights vLLM's continuous-batching advantage versus Ollama under high concurrency, defines related metrics (P99 latency, time to first token / TTFT), and provides practical measurement advice using tools like Ollama and vLLM and calculators from notAcalculator. The article also gives realistic tok/s expectations for different model sizes on consumer hardware and lists practical tips for reading and running benchmarks yourself.

• Tokens are the unit of both billing and speed for LLMs; tokenization affects cost and measured tok/s.
• Under a Red Hat benchmark on an A100 40GB with Llama 3.1 8B, vLLM peaked around 793 tok/s combined throughput versus about 41 tok/s for Ollama at high concurrency (~19x gap).
• vLLM's key innovation is continuous batching (plus PagedAttention), which increases total throughput under concurrency compared with single-request processing tools.

Spring Boot IAM: OAuth2 Redirect Bug in Production

The author built identityCore, a self-hosted Identity & Access Management (IAM) service in Spring Boot, implementing form login plus Google (OIDC) and GitHub (OAuth2) logins, RBAC stored as JPA entities, and a unified provisioning flow. The post explains key differences between OAuth2 and OIDC (GitHub returns an opaque access_token requiring extra API calls; Google returns an id_token JWT), and describes a production-only bug where OAuth2 logins failed with redirect_uri_mismatch because TLS was terminated upstream and the app ignored X-Forwarded headers. The one-line fix was to set server.forward-headers-strategy=framework so Spring trusts proxy headers. The author lists operational lessons about protocol differences, deployment vs demo differences, and centralized user provisioning.

• identityCore is a self-hosted IAM service built with Spring Boot (stack: Spring Boot 3.3.5, Spring Security 6.3.4, Spring Data JPA, PostgreSQL/H2, Thymeleaf, HikariCP, BCrypt).
• The system supports three login paths (form login, Google via OIDC, GitHub via OAuth2) that resolve to a single UserEntity and use JPA RoleEntity / PermissionEntity for RBAC.
• GitHub returns an opaque access_token requiring downstream calls (e.g., GET /user and /user/emails) to obtain a verified email; Google returns an id_token (JWT) containing email and email_verified claims.