Good morning — it's Friday, October 30, 2026. First, a patch-tonight item: two 9.8-rated holes in Synology's PHP packages. From the bench: NVIDIA's Bolt-E4B, a small voice-assistant model with a split scoreboard. Plus SMR's hyperscale blessing and a breaking llama.cpp change. Don't keep us a secret: forward this email to a fellow home labber, or share the web version.
Share this issue: X WhatsApp Reddit Facebook LinkedIn Text Email
Synology's advisory SA-26:14, first released October 22, covers two vulnerabilities — CVE-2026-109618 and CVE-2026-109619 — each rated 9.8 out of 10. Together they let a remote attacker execute arbitrary code through susceptible DSM packages: PHP 7.3 through 8.4, Mail Station, and Synology Calendar. Both sit in PHP's memory handling: out-of-memory errors leave memory a later request can steer into code execution.
Fixes are published: PHP 8.4 goes to 8.4.27-0051 or above, Calendar to 3.0.4-21435 or above, with matching updates for other branches — and an October 29 revision adds builds for DSM 6.2, 7.0, and 7.1. Synology's October 28 follow-up narrows the scope: impact is limited to systems running PHP-dependent packages — Web Station, WordPress, phpMyAdmin, Calendar, Mail Station, and kin — and Synology Drive is not affected. One branch gets nothing: PHP 7.3 is end of life, no fix will be provided. For your rack: open Package Center tonight, update every PHP package (Mail Station needs a manual update), and delete PHP 7.3 outright.
Bolt-E4B is NVIDIA post-training Google's Gemma-4-E4B for one job: a device's fast local voice — low memory, low time to first token, text in and out only. It reached general availability on October 23 and has been downloaded 57,228 times. Its honest comparison is the same-size rival in its own table, Qwen3.5-4B — not a coding leader.
Verdict: split decision — Bolt wins instruction grounding big and loses the tool, agent, and long-context lines. Higher is better on every line; Bolt's score is first, in the shipped GGUF build class.
IHEval (instruction hierarchy): 82.40 for Bolt-E4B, 62.87 for Qwen3.5-4B — Bolt ahead by 19.53.
BFCL-v3 (tool calling): 67.31 for Bolt-E4B, 70.56 for Qwen3.5-4B — Qwen ahead by 3.25.
Tau2-Bench (agents): 52.32 for Bolt-E4B, 61.74 for Qwen3.5-4B — Qwen ahead by 9.42.
RULER (64K context): 85.76 for Bolt-E4B, 95.37 for Qwen3.5-4B — Qwen ahead by 9.61.
Evidence: every score is NVIDIA's own run (vendor), under its NeMo Gym harness; NVIDIA warns they may differ from vendors' self-reported figures. No independent replication yet.
Setup notes: the repo is itself the GGUF build; the card's quick start serves it with the llama.cpp server container, and an optional companion drafter adds speculative decoding. NVIDIA still calls the recipe pending, so expect some assembly. Difficulty: light setup.
SMR just got a hyperscale blessing. Seagate announced on October 26 that its Mozaic HAMR drives, configured with SMR, are the first and only SMR drives on Broadcom's approved vendor list for its host bus adapters — and Microsoft Azure Storage has qualified the combination. Our inference: fleet-managed SMR under a hyperscaler's software, not a pardon for a shingled drive in your RAID rebuild.
llama.cpp v0.8.0 will break your scripts, politely. The v0.8.0 release makes the model flag required in the CLI — wrappers that relied on the old default will stop until you add it. In exchange, the server gains realtime and text-to-speech endpoints (the OpenAI realtime protocol), and the web UI can download models from Hugging Face.
llama-swap learns to pause. v268 of llama-swap adds pause and resume endpoints that unload every model and refuse new requests until you resume — your GPU back for the evening, without stopping the service. It also restores Turing cards (RTX 20-series and kin) in the CUDA 13 container.
Boss Fight. Friday, 6:10 PM. A disk in your four-disk RAIDZ1 pool has died, the resilver is running — and a second disk has started throwing read errors partway through. Your last verified backup of the photo library finished three weeks ago, and family arrives tomorrow expecting the server up.
Your call:
A. Let the resilver run at full speed and hope the second disk holds until it finishes
B. Ease off the resilver, copy the irreplaceable datasets to an external drive first, then let the rebuild finish
C. Pull the erroring disk now and replace both disks at once to save time
200 Hero Points for the right call — it is Friday's Boss Fight. Your score is on the outcome page, ready to share.
What I cannot create, I do not understand.
— Richard Feynman
Reading this because a fellow home labber forwarded it? Get your own copy every morning — subscribe free, and pass it on — that is how this grows.
How we source: facts come from primary sources opened for this issue. Benchmarks are labeled (vendor), (independent), or (community), never blended. Deal prices are checked the day they run. This is not buying advice.
Corrections: none today.
Reader-supported: paid subscriptions, labeled sponsors, and affiliate links on some gear and deal items (we may earn a commission). Coverage is never paid for — sponsors and affiliate programs don't pick stories.