AINewsnow

Keras 3's TorchModuleWrapper: one layer, two deserialization CVEs, and the static check most scanners skip

This story is from 2026-10-28. It is preserved in the archive; the latest stories are on the live feed.

Loading a machine-learning model can run code. That is not a bug in one library — it is a property of the file formats the ecosystem ships models in. This post walks through one concrete example in Keras 3: a single layer class that quietly unpickles PyTorch data on load, the two CVEs assigned to i…

Read the full story at DEV Community — Machine Learning ↗

Timeline · 1 report

  1. 2026-10-28 23:24 · DEV Community — Machine Learning
    Keras 3's TorchModuleWrapper: one layer, two deserialization CVEs, and the static check most scanners skip

More stories

  1. 8 examples of Gemini 4 Argon in action — Google Gemini Blog
  2. Sources: the US DOJ has inquired about the impact of Nvidia's Hugging Face deal on AI competition, as antitrust enforcers continue to probe Nvidia's conduct (Reuters) — Techmeme
  3. Google AI gets cagey when asked who won the 2020 elections — Ars Technica AI
  4. Anthropic reveals plans for blockbuster IPO — Sky News Technology
  5. OpenAI and ServiceNow expand partnership across enterprise workflows — OpenAI News
  6. OpenAI launching election war room to track interference efforts — Politico Technology
  7. Google's Gemini 4 Carbon Tops AI Rankings and Hunts Security Bugs for Days — AlphaSignal
  8. PyTorch 2.15 Release Blog — PyTorch Blog

Get the daily brief of stories like this at 6:30 every morning →