JetBrains open-sourced Mellum2.1 — an Apache-2.0 coding-agent model scoring 47% on SWE-bench Verified while activating only 2.5 of its 12 billion parameters per token. Weights are live on Hugging…
AspireAI community · huggingface.co
JetBrains open-sourced Mellum2.1 — an Apache-2.0 coding-agent model scoring 47% on SWE-bench Verified while activating only 2.5 of its 12 billion parameters per token. Weights are live on Hugging Face today.
Architecture is unchanged from June's Mellum2 — same 12B MoE, 2.5B active, 131K context. The real change is post-training: RL moved from a short final stage to the main event, with millions of sandboxed runs in real repositories using shell and file tools. Every compared model used the same open-source Pi v0.73.1 agent harness.
JetBrains-reported numbers on that harness: AIME 25/26 83.3, LiveCodeBench v6 82.0, SWE-bench Pro 28, Terminal-Bench 2.1 17.4. Qwen3.5-9B on the same setup: 50.0 / 75.4 / 38.0 / 21.7.
Limits: GGUF/Ollama/LM Studio and vLLM's MTP head are still "coming soon," the ~2× throughput claim needs those, and every number is JetBrains self-reported.
Source:
Read the story and explore more from the AspireAI community.
Two critical PHP remote code execution flaws — one found by GPT-5.6 Sol — were patched on October 21, 2026, and OpenAI published a disclosure framework alongside the fix. Fixed versions: PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Both allow unauthenticated remote code execution, and PHP's advisory says risk is highest for mod_php, where a demonstrated exploit triggers before any application code runs. The CVEs are distinct failure modes. CVE-2026-109618 (OOM corruption): out-of-memory handling can interrupt PHP while internal request data is only partially initialized, and request cleanup may then treat the invalid data as valid. CVE-2026-109619 (stale global state): request-owned internal state can survive after its backing memory is freed, and a later request served by the same worker may use that stale state. OpenAI states GPT-5.6 Sol identified the first flaw through its Patch the Planet initiative, and that Wiz independently discovered and reported both vulnerabilities. PHP's maintainers led the fixes and release, with Wiz, Cloudflare and OpenAI contributing research and coordination. Wiz's write-up adds that it used GPT-5.6 Sol and Gemini 4 Argon throughout, with Gemini 4 Argon contributing to finding the vulnerability and validating the patch. OpenAI describes the gap between discovery and public exploitation as a "Defender's Window," proposes a five-stage response framework, and committed $1 billion in subsidised Daybreak model access for organizations with limited security resources. Honest caveats: these are OpenAI's and Wiz's own characterizations, and OpenAI also notes the same capabilities help attackers build offensive tooling faster. PHP 8.1 and older no longer receive updates from the PHP project.