TLDR Tech / DevOps
CVE-2026-33626: How attackers exploited LMDeploy LLM Inference Engines in 12 hours
A critical SSRF vulnerability in LMDeploy, an AI model-serving toolkit with 7,798 GitHub stars, was exploited just 12 hours and 31 minutes after its public disclosure, with attackers using the vision-language image loader to port-scan AWS metadata services, Redis, MySQL, and other internal targets in an eight-minute session. The rapid weaponization occurred without any public proof-of-concept code, highlighting how detailed security advisories now serve as exploit blueprints in the age of AI-assisted coding—particularly ironic given the vulnerability targeted an LLM-serving framework itself.
Read the full story