#python

2 articles tagged

Dark hero graphic titled FaceHugger breaks trust_remote_code, listing three Diffusers CVEs and the 0.38.0 fix

AI Tools · Aug 4, 2026 · 15 min read

3 Diffusers CVEs let a Hugging Face model repo run code with trust_remote_code off

Zafran Security's FaceHugger research showed three ways a crafted Hugging Face repo runs Python during from_pretrained even when trust_remote_code is False. Here is the patch path and the policy.

Manu Shukla

#AI security #supply chain security #hugging-face

Developer workstation at night lit in teal and indigo, showing layered code panels on a curved monitor

Engineering · Aug 3, 2026 · 22 min read

Python 3.15 upgrade guide: lazy imports, the abi3t wheel break and a JIT worth 8-9%

Python 3.15 reaches release candidate 1 on 4 August 2026 and ships 1 October. The four changes that cost real engineering time: PEP 810 lazy imports, the abi3t ABI, UTF-8 defaults, and an 8-9% JIT.

Manu Shukla

#python #platform engineering #performance