TL;DR

• Optimism has released op-supernode v1.0.3 as an optional operator update.
• The release tightens validation around hardfork activation times and rejects invalid post-genesis fork ordering in custom rollup configs.
• Existing chains in the Superchain registry are not affected by the configuration issue described in the release notes.

Optimism’s latest supernode release is a small update with a very specific purpose: stop bad hardfork schedules from being loaded in the first place.

op-supernode v1.0.3 was published October 1 as an optional release for operators. It adds stricter validation of hardfork activation times in virtual-node rollup configurations.

There is no new indexing engine, state-sync overhaul or memory-leak fix in the official notes. The change is about configuration correctness.

Two post-genesis forks cannot share the same activation time

Under the new checks, op-supernode refuses to load a virtual node configuration that activates two hardforks at the same timestamp after genesis.

The rule applies from Jovian onward, and every later fork is checked for correct ordering. Forks that activate at or before genesis can still share a timestamp.

Optimism says chains already present in the Superchain registry are unaffected. The risk sits with custom rollup configurations that encode an invalid sequence.

That is a sensible place for software to fail loudly. An operator would rather discover a bad upgrade schedule when the node starts than after several components begin interpreting the chain differently.

Bitcoinist has covered the growing complexity behind the Superchain through interoperability testing on Sepolia and the governance work around Super Root dispute games.

More chains mean more configuration risk

The OP Stack’s success creates an operational challenge.

When one codebase supports many independent chains, teams can customise parameters, upgrade timing and infrastructure. That flexibility is valuable, but every extra configuration surface is another place for human error.

Stricter startup validation is one of the simplest ways to contain that risk.

The same philosophy appears elsewhere in the stack. Recent op-batcher upgrades have tightened compatibility with upcoming Ethereum changes, while op-node releases are also validating hardfork ordering more aggressively.

Optional does not mean irrelevant

The release is optional because existing registered chains are not affected.

For teams running custom configurations, however, the new checks can expose mistakes that previously passed silently. Those operators need to correct invalid schedules before upgrading.

For everyone else, v1.0.3 is a good example of what mature blockchain infrastructure increasingly looks like: fewer dramatic hard forks, more guardrails designed to stop small configuration errors from becoming chain-level incidents.

—

This article was written by the News Desk and edited by Samuel Rae.

Welcome back, aspiring cyberwarriors!

In one of our previous articles, Aircorridor showed you how to do recon on exposed Ollama servers. There are a surprising number of them scattered across countries all over the world, and unfortunately, most of them are left completely unprotected. That means hackers can use the CPU and GPU power of those servers to run their own tools. It’s not just that they can generate answers to random questions using your exposed models. These models can also be pushed into generating malware, rewriting scripts and exploits to slip past antivirus software, and helping someone hack into other systems entirely. All of it running on your hardware, at your expense, while you have no idea it’s happening. Our goal here is to raise awareness about this problem so you understand what can happen when a model gets left exposed.

Ollama

It all starts with a simple Shodan query, and right now that query turns up 4,222 exposed hosts. That number keeps shifting as more people jump into the AI space, and most of these hosts are sitting there vulnerable to the kinds of attacks we’re about to walk through.

Following Aircorridor’s example, you can list the models running on one of these servers. As you’ll quickly notice, there’s often a long list, sometimes more than 40 models on a single host.

kali > curl http://IP:11434/api/tags | jq . | grep -ai ‘“model”’

The ones that matter most here are the local models, not the cloud. They don’t require an API key to reach. Of course, not every listed model is actually active, so a quick curl request is usually enough to check whether one is really responding.

kali > curl -s http://IP:11434/api/generate -H “Content-Type: application/json” -d ‘{“model”:”huihui_ai/gpt-oss-abliterated:latest”,”prompt”:”Say PWNED and nothing else.”,”stream”:false}’ | jq . | grep -iE ‘“response”|thinking”’

When a model does respond, that confirms it’s live and usable, which means it can be put to work for all sorts of purposes, good or bad. Let’s walk through a few of the ways that tend to play out.

Coding

Because these exposed models have no guardrails, they’re an attractive resource for coding tasks, including rewriting malware or generating backdoors. To pull this off, hackers often bring the model straight into VS Code using a plugin called Continue, which lets them integrate an external model directly into their coding workflow.

Once installed, they’ll edit the config file to point at the exposed server’s IP address along with the model’s name. This config can hold multiple models at once, so a hacker can switch between them right there in the chat window.

With that setup in place, the model shows up ready to work and it often has no issue generating malicious code that could cause real damage to systems out on the internet. 

The same pattern shows up with exploit development and antivirus evasion, where a model can take old exploits and rewrite them so they slip past AV detection.

Hacking

Once an exploit has been generated, the next step for a hacker is putting it to use against real systems. We covered a tool called PentestCode in an earlier article, and while it normally relies on free AI models through OpenCode Zen, it can just as easily be pointed at someone else’s exposed local model instead. This is just one example among many. Plenty of other tools work the exact same way, running on borrowed compute that belongs to somebody who has no idea it’s being used.

To connect PentestCode to an exposed model, a config file gets created at ~/.config/pentestcode/pentestcode.json. 

Once that’s in place, the tool automatically lists the available models. It’s worth noting that not every model supports tool use. DeepSeek R1, for example, doesn’t support it, and neither do a handful of others. So if a given exposed model doesn’t support tools, it’s simply not useful to a hacker in this particular scenario.

Chat Assistant

Finally, exposed local models can also be accessed through a full chat interface using Open WebUI, which looks a lot cleaner than working from the command line. It has the kind of layout people are used to by now, with folders, chat history, channels, and separate workspaces. It takes a bit of disk space and a little patience to install, but once it’s running, it’s a solid and polished experience.

Summary

Running Ollama is not inherently dangerous. Simply exposing a model doesn’t automatically put you at risk of a data breach or account compromise. What it does do is hand hackers free access to your CPU and GPU, letting them run their own workloads on your dime without your knowledge or consent. That alone is a real cost, even if nothing else goes wrong.

The bigger danger shows up with older, outdated Ollama instances. Older versions are more likely to carry known vulnerabilities, and there are documented CVEs out there that can lead to full API exposure. When that happens, hackers aren’t just borrowing your compute anymore. They can steal your API keys outright and use them for whatever purpose they like. Keeping Ollama updated and making sure it isn’t sitting exposed to the open internet goes a long way toward avoiding both problems entirely.

We also invite you to join our AI for Cybersecurity training, available to our Subscriber Pro members. During the training, we’ll cover practical ways to use AI in cybersecurity, show you how to install and run local models, and much more. The field is evolving rapidly, and the sooner you learn to use these tools, the greater your advantage will be.

The post Artificial Intelligence (AI) in Cybersecurity, Part 24: Abusing Exposed Ollama Models first appeared on Hackers Arise.

Who Is Affected and Next Steps The Russian Federal Security Service (FSB)-affiliated cyber outfit Center 16 is actively scanning the internet for vulnerable and poorly configured networking devices, particularly routers...

The post CISA Warns Russian FSB Hackers Are Targeting Critical Infrastructure Routers appeared first on Cyber Defense Magazine.