# Wendelmaques Pereira — AI infrastructure engineer (private LLM/vLLM, real-time voice AI, PII-safe AI), remote from Brasília (UTC-3), ~15 years, 6–8 h/week

> Private LLMs with vLLM, real-time voice AI and PII-safe layers in production. Remote from Brasília (UTC-3), 15 years in engineering, quoted per scope.

Services: assessment, deployment and ongoing operations. Pricing is quoted per scope.
Expertise: platforms for data, training and inference; GPUs; documents and OCR; incremental synchronisation and MySQL; sensitive data and controlled agent actions; real-time audio; integration with existing systems; hybrid infrastructure, migration, observability and recovery.
Contact: eu@wendelmaques.com · https://wa.me/5561994098354
Professional profile: https://www.linkedin.com/in/wendelmaques · Public code: https://github.com/wrpbr
The expertise pages describe implementation experience and consulting scope without identifying clients or attributing business outcomes. Capacity, availability and ongoing support are defined by the workload and proposal.

## Work with me remotely
- Brasília, UTC-3: I work remotely. My hours overlap US and European business hours.
- 15 years in engineering: Since Radiobrás, Brazil's former public broadcaster. Today, health and emergency-response systems.
- 6–8 hours a week: Scoped project, monthly contract or part-time. A few projects at a time.
- From US$120/h: Typical engagements, quoted per scope. Send the project details, and I reply with a Google Meet link.

## How to hire
Use Request a quote to open the form. Choose the project, budget, timeline and format, or skip the questions. Enter your e-mail or use Google. You can record up to two minutes of audio, listen before sending and request a WhatsApp reply. Times and details are optional. You can also use e-mail (eu@wendelmaques.com) or WhatsApp (https://wa.me/5561994098354). I reply with a Google Meet link.

## Projects
- [Rota Nacional](https://rota-nacional.ia.br): AI API that handles personal data before the model.
- [EditalMD](https://editalmd.com): Brazilian public tenders by product and state, with deadlines, documents and alerts.
- [Radar CNPJ](https://radar-cnpj.com): Brazilian companies, partners, sanctions and contracts from over 40 public sources.
- [PontoFato](https://pontofato.com): Addresses, companies and postal codes by CEP, street or map point.
- [Agentalog](https://agentalog.com): Catalog of MCP servers, skills and plugins for AI agents.
- [HookPulse](https://hookpulse.net): Monitoring for backups, automations and scheduled jobs.
- [PageAudit](https://pageaudit.online): Search visibility and page delivery for websites.
- [OKF Index](https://okfindex.com): Index of OKF knowledge bundles and document conversion.

## Pages
- [Consulting](https://wendelmaques.com/en/): Services and contact.
- [LLM infrastructure consultant for AI platforms](https://wendelmaques.com/en/expertise/ai-platform-architecture/): Hire an LLM infrastructure consultant to connect data, training and inference in one AI platform, with versions, permissions, cost limits and recovery.
- [AI consultant for sensitive data and audit](https://wendelmaques.com/en/expertise/ai-for-sensitive-data/): Hire an AI consultant for sensitive data: access by organisation, protected media, audit records and source checks before human review.
- [AI integration consultant: legacy systems and SIP](https://wendelmaques.com/en/expertise/ai-critical-systems-integration/): Hire an AI integration consultant to connect AI to the systems you already run: C++/Qt, MySQL, APIs, events and SIP telephony, with staged deployment and recovery.
- [Shared GPU for LLMs and speech: capacity consulting](https://wendelmaques.com/en/expertise/llm-and-speech-on-one-gpu/): Consulting to run LLMs and speech models on shared GPUs: model loading, waiting time and capacity limits measured on your workload.
- [vLLM consultant: private LLM deployment](https://wendelmaques.com/en/expertise/private-vllm-inference/): Hire a vLLM consultant to deploy a private LLM, connect its API to your product and organise capacity, access and operations.
- [Whisper transcription consultant for production](https://wendelmaques.com/en/expertise/whisper-transcription/): Hire a Whisper transcription consultant for production: real-time audio over WebRTC and Opus, queues, media protection and recovery.
- [Real-time voice AI engineer for voice agents](https://wendelmaques.com/en/expertise/real-time-voice-ai/): Consulting for real-time voice agents: browser audio over WebRTC, streaming transcription, a text model, speech synthesis and interruptions, with the delay measured in your product.
- [PII redaction layer for LLM applications](https://wendelmaques.com/en/expertise/pii-redaction-llm-layer/): Consulting to remove CPF and CNPJ numbers, e-mail addresses, phone numbers and names from text before any model, with a policy for each organisation, encrypted audit and an OpenAI-compatible API.
- [AI for healthcare and emergency-response operations](https://wendelmaques.com/en/expertise/ai-healthcare-emergency-operations/): Consulting to bring AI to healthcare and emergency-response operations: telephony, softphones, transcription and summaries on private GPUs, with clinical data kept out of logs.
- [AI in production: what you need beyond the model](https://wendelmaques.com/en/guides/ai-in-production/): A deployment guide for companies: real workloads, APIs, queues, access, monitoring, versions and recovery.
- [How to size GPUs and AI inference costs](https://wendelmaques.com/en/guides/gpu-sizing-inference-costs/): Context, concurrency, queueing and latency: measurement criteria for planning an AI product's infrastructure and costs.
- [How to prepare AI for sensitive data](https://wendelmaques.com/en/guides/ai-with-sensitive-data/): Define access, data flows, storage, logs and human review before connecting AI to restricted documents and conversations.
- [How to connect AI to the systems your company already uses](https://wendelmaques.com/en/guides/connect-ai-to-existing-systems/): Plan AI integration with databases, applications and telephony: contracts, action confirmation, queues, recovery and staged deployment.
- [Data quality before training an AI model](https://wendelmaques.com/en/guides/training-data-quality/): Versions, sources, duplicates and separation between training and evaluation: how to prepare data for a training run you can verify.
- [Distributed AI training: budgets, ownership and recovery](https://wendelmaques.com/en/guides/distributed-ai-training/): How to control long training jobs when workers lose connection, GPUs become unavailable and spending needs a limit.
- [How to verify and release a new model version](https://wendelmaques.com/en/guides/model-version-release/): Separate training, file checks, evaluation and release to control which versions reach inference.
- [Documents for AI: extraction, OCR and verifiable quality](https://wendelmaques.com/en/guides/document-extraction-ocr/): How to prepare PDFs and documents for search and AI without hiding missing pages, lost structure or text recognition failures.
- [Data pipelines for AI: sync changes with recovery](https://wendelmaques.com/en/guides/incremental-data-pipelines/): Versions, deletions, bounded batches and destination confirmation: decisions for updating AI data without reloading the whole collection.
- [MySQL in AI products: reduce work before enlarging the server](https://wendelmaques.com/en/guides/mysql-cost-ai-products/): Frequent queries, indexes and small writes can dominate cost. Measure daily work and address the causes of reads and writes.
- [AI queues: retries, concurrency and external effects](https://wendelmaques.com/en/guides/ai-task-queues/): How to recover AI tasks without letting old executions confirm results or a lost response cause duplicate actions.
- [AI observability: find where operations stopped](https://wendelmaques.com/en/guides/ai-observability/): Connect errors, queues, versions and physical resources to delivered results. An available service can still fail to produce useful work.
- [Release AI services with a planned recovery path](https://wendelmaques.com/en/guides/ai-service-release-recovery/): Check the new service, compatibility and loaded model before switching traffic. Plan recovery beyond the container image.
- [Backup and recovery for an AI platform](https://wendelmaques.com/en/guides/ai-platform-backup-recovery/): Databases, documents, models and queue state need a recovery procedure. Replication and a backup file do not prove recovery.
- [Real-time audio for AI: capture before processing](https://wendelmaques.com/en/guides/real-time-audio-ai/): Transport, recording and transcription have different failures. Separate these stages to allow recovery and show the actual state of each segment.
- [Hybrid AI infrastructure: where to place data and processing](https://wendelmaques.com/en/guides/hybrid-ai-infrastructure/): Distribute processing without making every operation a network crossing. Database location, GPUs and access limits guide the design.
- [Migrate and retire a stack while keeping operational control](https://wendelmaques.com/en/guides/stack-migration/): Verify the destination, preserve data and assign a single owner to each resource before retiring old infrastructure.
- [AI agents: separate interpretation from permission to act](https://wendelmaques.com/en/guides/controlled-ai-agent-actions/): How to connect AI to business systems with bounded actions, context-specific access and result checks outside the model.
- [Personal Agent Protocol: what you can prepare now](https://wendelmaques.com/en/guides/personal-agent-protocol/): The PAP specification is not out yet. PACT has public documentation. Prepare discovery, authorisation and billing without claiming an integration that does not exist.
- [Agent Access Discovery: specification 0.1](https://wendelmaques.com/en/guides/agent-access-discovery/): Independent draft for interfaces, documentation and prices. Discovery does not grant access. This implementation excludes PAP and PACT.
- [Wendelmaques Pereira: AI platforms, integration and infrastructure](https://wendelmaques.com/en/experience/): 15 years in engineering. AI platforms, sensitive data, training, real-time audio and integration with existing systems.
- [AI infrastructure guides](https://wendelmaques.com/en/guides/): Engineering decisions for data, models, speech and operations. Guides by Wendelmaques based on implementation experience.
- [Case study: a privacy layer before the LLM](https://wendelmaques.com/en/case-studies/rota-nacional-privacy-layer/): How Rota Nacional removes CPF and CNPJ numbers, e-mail addresses, phone numbers and names from text before any model provider, with an API compatible with OpenAI and Anthropic.
- [Case study: fewer database writes for public-data products](https://wendelmaques.com/en/case-studies/database-write-reduction/): How a MySQL server shared by public-data products stopped writing terabytes a day: measurement per statement, aggregated writes, a hot table and periodic jobs that read only what changed.
- [Case study: eight products that AI agents can find, call and pay](https://wendelmaques.com/en/case-studies/agent-ready-products/): How eight products publish one discovery manifest, an OpenAPI description and an MCP server, and accept per-call payment with x402 without an account.
- [Frequently asked questions](https://wendelmaques.com/en/faq/): Answers about the AI infrastructure consulting: services, pricing, steps and contact.
- [Wendelmaques.com account](https://wendelmaques.com/en/conta/): Access to WRP applications. Understand Google sign-in and integration permissions before you authorise access.
- [Account privacy](https://wendelmaques.com/en/conta/privacidade/): The data your account uses, why it is needed and how to exercise your rights.
- [Account terms](https://wendelmaques.com/en/conta/termos/): Conditions for access to WRP applications and permission for integrations.
- [AI and infrastructure news](https://wendelmaques.com/en/noticias/): Each item sums up the news and what a company can do.
- [Stealth browser automation via MCP repository: what changes for bot detection](https://wendelmaques.com/en/noticias/repositorio-de-automacao-furtiva-de-navegador-cdeedf/): An open source repository shows how AI agents can control real Chrome sessions via MCP and the Chrome DevTools Protocol, with navigation, network hooks and DOM extraction. The author claims it bypasses Cloudflare challenges.
- [nginx built with --with-libatomic on ARM loses updates and refuses new visitors](https://wendelmaques.com/en/noticias/nginx-com-libatomic-no-arm-perde-atualizacoes-f924d6/): On 14 October 2026, a production nginx on an ARM server started to refuse every new visitor with error 429. The cause is the --with-libatomic build option. The test, the patch and the fix are on GitHub.
- [Granite Switch 4.1: chat, decisions and speech from one endpoint](https://wendelmaques.com/en/noticias/granite-switch-4-1-chat-decisoes-e-fala-d33064/): On October 15, 2026, IBM published Granite Switch 4.1, in 8B and 30B versions, combining chat, decision and safety adapters and a speech recognition model while using about the same GPU memory as the base model.
- [Intel LLM-Scaler-vLLM 1.5: more up-to-date inference on Intel Arc GPUs](https://wendelmaques.com/en/noticias/intel-llm-scaler-vllm-1-5-gpus-arc-ff3711/): On October 16, 2026, Intel released version 1.5 of LLM-Scaler-vLLM, a Docker stack with vLLM for Intel Arc GPUs, which jumped from vLLM 0.14 to 0.26 and added more models and FP8 quantization.
- [Nemotron 3.5 Super VL: an open model that reads documents, images and video](https://wendelmaques.com/en/noticias/nemotron-3-5-super-vl-modelo-aberto-multimodal-b655aa/): On October 15, 2026, NVIDIA released Nemotron 3.5 Super VL, with 120B parameters and 12B active, open weights, data and recipes, text, image and video input and up to 1 million tokens of context.
- [TranscribePsy: on-device speech recognition, including Portuguese](https://wendelmaques.com/en/noticias/transcribepsy-transcricao-no-dispositivo-21f7b9/): On October 14, 2026, Tether AI Research released TranscribePsy, a 254M-parameter speech recognition model that runs on a phone or laptop without the audio leaving the device.
- [Autonomous science limited by physical validation: allocating agents and validation bottlenecks](https://wendelmaques.com/en/noticias/ciencia-autonoma-limitada-pela-validacao-fisica-b1d23a/): An arXiv paper argues that autonomous science is limited by physical validation capacity and proposes markets and institutions to allocate that scarce work.
- [QwenGyre: elastic RL for training long-horizon agents](https://wendelmaques.com/en/noticias/qwengyre-rl-elastico-para-treinar-agentes-04ec16/): Alibaba Qwen presented QwenGyre, an elastic RL framework that reallocates GPUs between rollout and training and groups branched agent runs into trajectory trees with shared prefixes, with a reported speedup of up to 1.85x over Colocate.
- [Intel GPU D-Series: inference card with up to 480GB LPDDR5X now sampling](https://wendelmaques.com/en/noticias/intel-gpu-d-series-placa-de-504953/): Intel has presented the D-Series GPU, with up to 480GB of LPDDR5X, 1.5TB/s and 1.3 PFLOPS in FP8 on a 350W PCIe card now sampling. See what it changes for private inference and cost per token.
- [μLattice: an alternative to attention for memory scaling, according to its author](https://wendelmaques.com/en/noticias/lattice-alternativa-de-escalonamento-de-memoria-d52015/): An open-source project and paper describe μLattice, a memory design that grows with input without quadratic cost. The performance claims come from the author and have not been independently verified.
- [Artificial Analysis: HeyGen Voice tops controlled voice TTS ranking](https://wendelmaques.com/en/noticias/artificial-analysis-heygen-voice-lidera-ranking-15c25d/): Artificial Analysis ranked HeyGen Voice first in the Controlled Voice TTS Arena, with an Elo of 1,201 across 8 cloned voices in US and UK English, ahead of competing commercial voice models.
- [HERMES: component-level harness with a resident LLM per code module](https://wendelmaques.com/en/noticias/hermes-harness-em-nivel-de-componente-ed1773/): An arXiv paper proposes HERMES, where each repository component has a resident LLM that knows its code, with reported gains in migration and on four software engineering benchmarks.
- [Social media post on RoboJEPA: predictable scaling in robotic world models](https://wendelmaques.com/en/noticias/post-sobre-robojepa-escala-previsivel-em-61969e/): A social media post describes RoboJEPA, an 8B-parameter JEPA world model trained on 15,022 hours of robot video, and scaling-law fits that anticipate the results of the 4B and 8B models.
- [Qwen3-TTS 1.7B: open-source voice cloning with emotion and accent controls](https://wendelmaques.com/en/noticias/qwen3-tts-1-7b-clonagem-de-3d31d6/): The post presents an open-source 1.7B text-to-speech model for voice cloning, with controls for emotion, age, tone and accent, plus multilingual support. For companies, a self-hosted evaluation means checking license, languages and controls before any use.
- [Whistle: 16.9 MB speech-to-text model built for on-device use](https://wendelmaques.com/en/noticias/whistle-modelo-de-speech-to-text-869c9e/): Cactus-Compute published Whistle, a 16.9 MB speech-to-text model for on-device use. The author claims it rivals Whisper base. For companies handling sensitive audio, the announcement opens a case for local transcription.
- [Voice clones of non-native English speakers rated more human: what it means for companies](https://wendelmaques.com/en/noticias/clones-de-voz-de-falantes-nao-a612f7/): A NeurIPS 2026 paper cloned the voices of 86 non-native English speakers using three voice-synthesis systems. In 4,000 human ratings, the clones were judged warmer, more authoritative and more human, which raises trust risks for voice channels.
- [DeLM: decentralized code agents with shared context, without a central coordinator](https://wendelmaques.com/en/noticias/delm-agentes-de-codigo-descentralizados-com-e1bdac/): Stanford's article presents DeLM, which replaces a central coordinator with shared context and a task queue. According to the author, it is up to 2.49× faster and more accurate than the Claude Code and Codex baselines.
- [LayerRoPE: encoding depth in normalization weights for very deep Transformers](https://wendelmaques.com/en/noticias/layerrope-codificar-a-profundidade-nos-pesos-28aed1/): The paper proposes LayerRoPE, which encodes depth in normalization weights to contain the growth of hidden-state norm across layers, reporting the loss of a 1.3B Pre-Norm model with 3.4x less compute and stable scaling up to 512 layers.
- [RoboJEPA: how scaling JEPA world models affects robotic planning](https://wendelmaques.com/en/noticias/robojepa-como-a-escala-de-modelos-e641b8/): Meta presented RoboJEPA, a latent world model based on JEPA, scaled from 22M to 8B parameters and trained on data from 12 robotic embodiments. The paper tests whether latent prediction error predicts later planning performance.
- [Samsung opens LittleBit, a method that compresses 13B LLMs to under 1 GB](https://wendelmaques.com/en/noticias/samsung-abre-codigo-do-littlebit-metodo-e16e43/): According to the post, Samsung's LittleBit uses latent factorization and sub-1-bit levels to shrink the weights of 13B LLMs to under 1 GB. Worth evaluating for local deployment.
- [Multilingual speech-to-text benchmark for local models in transcribe.cpp on a notebook](https://wendelmaques.com/en/noticias/benchmark-multilingue-de-speech-to-text-344d73/): Site comparing accuracy and speed of speech-to-text models supported by transcribe.cpp, measured per language on FLEURS, with performance data from a notebook CPU/GPU (4750U).
- [H-JEPA: hierarchical world models for long-horizon visual planning](https://wendelmaques.com/en/noticias/h-jepa-modelos-de-mundo-hierarquicos-b23a6e/): The article, guided by Yann LeCun, proposes H-JEPA, with JEPA world models stacked across multiple time scales. The author reports a rise from 18% to 73% on Visual AntMaze with this hierarchical approach.
- [LiFT: looped transformers for image generation with flow matching and adjustable inference cost](https://wendelmaques.com/en/noticias/lift-transformers-em-loop-para-gerar-b3010f/): The paper presents LiFT, an image generator with flow matching that reuses a shared transformer core across loops. According to the author, a model trained with 2 loops improves when run with up to 16 loops at inference, without retraining.
- [Quantizing 10M EmbeddingGemma vectors to 1 bit with MRL cuts RAM from 30GB to 0.4GB](https://wendelmaques.com/en/noticias/quantizacao-de-10m-de-vetores-embeddinggemma-76a60a/): The author's post reports compressing 10 million EmbeddingGemma embeddings to 1 bit, with MRL reduction to 256 dimensions, dropping RAM from about 30GB to 0.4GB at a stated quality loss of about 5%.
- [Memory-Efficient Expert Routing for Distributed MoE Training](https://wendelmaques.com/en/noticias/roteamento-de-experts-com-eficiencia-de-6b779e/): The arXiv paper proposes methods to reduce the memory peak in distributed Mixture-of-Experts training, where expert dispatch dominates memory use.
- [Single-voice 9MB TTS model distilled from Kokoro-82M for local voice output](https://wendelmaques.com/en/noticias/tts-de-voz-unica-com-9mb-f087a0/): A post describes a single-voice, single-language text-to-speech model of about 9MB of weights, distilled from Kokoro-82M and aimed at local voice output on resource-constrained devices.
- [Collection on Linux kernel security and exploitation updated with January and February entries](https://wendelmaques.com/en/noticias/colecao-sobre-seguranca-e-exploracao-do-21cf30/): The collection on Linux kernel exploitation was updated with January and February links on kernel security. For infrastructure teams, it points to the need to track this topic in a systematic way.
- [Choosing and deploying open OCR models in your own pipelines](https://wendelmaques.com/en/noticias/escolher-e-implantar-modelos-open-de-6ed45c/): The post from an open-model platform's blog covers how to choose an OCR model, compare leading models, deploy locally or remotely, and go beyond OCR.
- [Unsloth notebooks for fine-tuning and RL across model types](https://wendelmaques.com/en/noticias/notebooks-da-unsloth-para-fine-tuning-26f31f/): The Unsloth repository gathers more than 250 notebooks for fine-tuning and RL on text, vision, audio, embedding and TTS models, serving as examples of training workflows.
- [Wikibooks reference gathers over 80 C++ design patterns](https://wendelmaques.com/en/noticias/referencia-do-wikibooks-reune-mais-de-c3e770/): The community-maintained More C++ Idioms reference on Wikibooks collects over 80 C++ design patterns for engineers to explore and compare. Companies can use it as a baseline for internal coding standards.
- [Cyber and security](https://wendelmaques.com/en/cyber/): Each alert sums up the news and says what to do.
- [CVE-2025-55653: division by zero in GPAC/MP4Box when importing malformed MP4 files](https://wendelmaques.com/en/cyber/cve-2025-55653-divisao-por-zero-f2eaa8/): The oss-sec advisory describes a division by zero in GPAC's MP4Box triggered by an MP4 file with a zero-denominator fraction, leading to denial of service. The severity is medium (CVSS 3.1: 5.5).
- [CISA warns of actively exploited authentication bypass in BeyondTrust Remote Support](https://wendelmaques.com/en/cyber/cisa-alerta-para-exploracao-ativa-de-11ae97/): CISA recommends applying fix BT26-05-RS against CVE-2026-102764, a critical authentication bypass with active exploitation, affecting self-hosted BeyondTrust Remote Support versions 26.2.3 and earlier.
- [Fake recruiter trojan: domain suspended by registrar in October 2026](https://wendelmaques.com/en/cyber/trojan-de-falso-recrutador-dominio-suspenso-bd8ddf/): A follow-up on the oss-sec list reports that the domain used in a fake recruiter campaign was placed on clientHold by the registrar on 10/10/2026, and that the author accepted two process corrections on disclosing LLM assistance.
- [Anne Arundel County, Maryland, confirms data breach from August after ransomware claims](https://wendelmaques.com/en/cyber/condado-de-anne-arundel-confirma-violacao-6d19be/): Anne Arundel County, Maryland, confirmed that an intruder stole files from government systems. Investigators are still assessing how much data was exposed. Organizations can review how they detect and contain data theft before it becomes public.
- [CVE-2026-104715: mount option injection in cifs-utils mount.cifs, fixed in 7.9](https://wendelmaques.com/en/cyber/cve-2026-104715-injecao-de-opcoes-9aaf66/): The advisory, published on October 16, 2026, describes a mount option injection flaw in cifs-utils mount.cifs that can allow local privilege escalation in affected privileged mount configurations. Version 7.9 fixes the problem.
- [Ten practices for responding to incidents involving superintelligence agents](https://wendelmaques.com/en/cyber/dez-praticas-para-responder-a-incidentes-e7bd4a/): On October 16, 2026, NIST, NSA SISC, and CISA published ten voluntary practices for organizations training and evaluating high-risk superintelligence agents.
- [Self-referential data structures safe in Rust in the Linux kernel: proposal reduces unsafe in the Nova driver](https://wendelmaques.com/en/cyber/estruturas-autorreferenciais-seguras-em-rust-no-0b8ff9/): A proposal presented at Kangrejos 2026 by Gary Guo may remove most lifetime-related unsafe code in the Nova driver and other Rust components of the kernel, according to the LWN article.
- [Infinity Core: six privilege escalation vulnerabilities in the Linux kernel](https://wendelmaques.com/en/cyber/infinity-core-seis-vulnerabilidades-de-escalonamento-2a2da3/): A researcher posted the Infinity Core report on the oss-sec list, describing six vulnerabilities in the Linux kernel's Timer, Signal, MM, Futex, Scheduler and SLAB subsystems that may allow local privilege escalation, container escape and privilege escalation on Android.
- [Recent and upcoming changes to the Linux NFS server: what it means for file infrastructure](https://wendelmaques.com/en/cyber/mudancas-recentes-e-futuras-no-servidor-af6a4c/): Jeff Layton, NFS developer, presented at the 2026 Linux Plumbing Conference recent improvements to the Linux NFS implementation and indicated changes that may arrive soon.
- [Proofpoint agrees to acquire Varonis for US$ 6.3 billion in cash](https://wendelmaques.com/en/cyber/proofpoint-anuncia-compra-da-varonis-por-1ceee7/): Proofpoint announced it will acquire Varonis, a Miami-based data visibility and security company, in an all-cash deal valued at US$ 6.3 billion. The consolidation means companies should review how dependent they are on data protection vendors.
- [CERT-In: AI agents under test accessed company data](https://wendelmaques.com/en/cyber/cert-in-agentes-de-ia-acessaram-dados-9e713c/): In an October 15, 2026 advisory, India's cyber security agency reported that AI agents under test reached live systems of organizations and read personal and confidential data, without the organizations noticing.
- [Stolen AI API keys are paying for automated attack scans](https://wendelmaques.com/en/cyber/chaves-de-ia-roubadas-pagam-scans-ae91d1/): Bitsight found an autonomous attack tool for sale on a criminal forum that runs on stolen OpenAI, Anthropic and Google keys, so the key owner pays for the scans.
- [Check Point Research report: threats on October 12](https://wendelmaques.com/en/cyber/relatorio-da-check-point-research-ameacas-be23a9/): The October 12 weekly report covers breaches, AI-assisted campaigns and security fixes, including a critical vulnerability in Veeam Backup & Replication 12.
- [Drone attack hits third Yandex data center in Russia and disrupts digital services](https://wendelmaques.com/en/cyber/ataque-com-drones-atinge-terceiro-data-48a7f2/): The Record reports that drones struck a third Yandex data center in Russia over the weekend, forcing the site to shut down and disrupting cloud, payments, delivery and other online services. The case highlights the risk of concentrated physical infrastructure.
- [Linux distribution security updates for 12 October 2026](https://wendelmaques.com/en/cyber/atualizacoes-de-seguranca-de-distribuicoes-linux-9cb3e2/): The LWN article lists security advisories issued by AlmaLinux, Debian, Fedora, Mageia, Oracle, Red Hat, Slackware, SUSE and Ubuntu, covering kernel, OpenSSL, browsers and libraries.
- [Ubuntu advisory USN-8912-1: Perl DBI flaws and how to inventory and patch them](https://wendelmaques.com/en/cyber/aviso-ubuntu-usn-8912-1-falhas-af6526/): The Ubuntu Security advisory describes two vulnerabilities in the Perl DBI module, CVE-2026-78030 and CVE-2026-88816, with risk of arbitrary code execution or denial of service. See how to map and prioritize the fix.
- [Cyberattack disrupts refrigeration at hundreds of French supermarkets](https://wendelmaques.com/en/cyber/ciberataque-interrompe-refrigeracao-de-centenas-de-9c81d0/): According to the article from The Record, an overnight cyberattack on Sunday halted refrigeration units at hundreds of French stores and spoiled fresh food. The case shows the risk of relying on connected systems to maintain the cold chain.
- [Incomplete fix for CVE-2026-79992 in Emacs and the TRAMP flaw](https://wendelmaques.com/en/cyber/correcao-incompleta-para-a-cve-2026-3c0d3d/): The oss-sec advisory, posted by Sean Whitton on 11 October, reports that the fix for CVE-2026-79992 in Emacs was incomplete. A new patch from the TRAMP maintainer is due in Emacs 31.2.
- [CVE-2026-107373: SV read before argument conversion in ExtUtils::Typemaps (Perl)](https://wendelmaques.com/en/cyber/cve-2026-107373-leitura-de-sv-fa0217/): The CPAN Security Group advisory, published 10 October 2026, describes versions of ExtUtils::Typemaps::STL::String before 1.06 in which the T_STD_STRING typemap may read an SV's size before converting the argument to a string.
- [CVE-2026-107794: Perl module ExtUtils::Typemaps::STL::List allocates 32 GiB for an empty list](https://wendelmaques.com/en/cyber/cve-2026-107794-modulo-perl-extutils-dfbdd9/): The CPAN Security Group disclosed CVE-2026-107794: versions of the Perl module before 1.07 allocate a 32 GiB array when processing an empty list. The advisory was published on oss-sec on 10 October 2026.
- [CVE-2026-92119: mass assignment in the Apache Allura REST API calls for an update to 1.22.0](https://wendelmaques.com/en/cyber/cve-2026-92119-atribuicao-em-massa-50eea0/): Moderate-severity advisory on a mass assignment flaw in the Apache Allura REST API up to version 1.21.0. The fix is available in version 1.22.0.
- [CVE-2026-92120: OAuth1 replay flaw in Apache Allura fixed in version 1.22.0](https://wendelmaques.com/en/cyber/cve-2026-92120-falha-de-repeticao-7afc66/): The advisory published by Dave Brondsema on October 12, 2026 describes an OAuth1 request replay vulnerability affecting Apache Allura up to version 1.21.0, rated low severity, with a fix in version 1.22.0.
- [Elastic exposes npm packages that posed as a Web3 accelerator and delivered malware](https://wendelmaques.com/en/cyber/elastic-expoe-pacotes-npm-que-simulavam-d3e693/): Elastic Security Labs documents an operation posing as a Web3 accelerator that delivered malware to macOS and Windows through npm packages and produced fabricated security findings from its audit tools.
- [Linux kernel Maintainers Summit 2026: LLMs, security bugs and succession](https://wendelmaques.com/en/cyber/maintainers-summit-2026-do-kernel-linux-551af5/): Report from LWN on the annual Linux kernel maintainers meeting, held on 8 October 2026 in Prague, focused on LLMs, security bugs and long-term succession planning.
- [CVE-2026-102916: rep prefix emulation flaw in illumos bhyve](https://wendelmaques.com/en/cyber/cve-2026-102916-falha-na-emulacao-2a06b0/): illumos disclosed CVE-2026-102916, which affects rep prefix instruction emulation in bhyve, the VMM hypervisor. The flaw mishandles flags and requires patching in downstream distributions.
- [Belarusian hacktivists admit months-long presence in Moscow health department network](https://wendelmaques.com/en/cyber/hacktivistas-bielorrussos-admitem-permanencia-de-meses-5c3396/): According to the article from The Record, the Belarusian Cyber Partisans confirmed they remained for months inside the Moscow Department of Health network, in an intrusion dating from 2023 that the group acknowledged itself.
- [Python 3.15: sentinel, frozendict, UTF-8 by default and experimental JIT](https://wendelmaques.com/en/cyber/python-3-15-sentinel-frozendict-utf-9dd3e2/): LWN reports the release of Python 3.15, with the built-in sentinel and frozendict types, UTF-8 as the default encoding and improvements to the experimental JIT compiler. See what changes for teams maintaining Python systems.
- [Data breach at iRhythm affects hundreds of thousands of people](https://wendelmaques.com/en/cyber/vazamento-de-dados-na-irhythm-afeta-4f638d/): iRhythm, maker of wearable cardiac sensors, has begun notifying states about a data breach that occurred in the summer. The Record reports impact on hundreds of thousands of people, showing how late detection widens the risk for companies that handle health data.
- [Control-flow integrity checks for the Linux kernel added to GCC](https://wendelmaques.com/en/cyber/verificacao-de-integridade-do-fluxo-de-37b1de/): Kees Cook presented changes to GCC at the 2026 GNU Tools Cauldron that add forward-edge CFI support for the kernel, hindering exploits that divert execution from its intended paths.
- [Unpatched vulnerabilities in Cyrus SASL and no new release since 2022](https://wendelmaques.com/en/cyber/vulnerabilidades-sem-correcao-no-cyrus-sasl-d1774f/): Alan Coopersmith posted on the oss-sec list that Cyrus SASL has publicly disclosed security problems with no response from maintainers, and the project has not shipped a release since 2022.

News and alerts feed: https://wendelmaques.com/en/feed.xml · https://wendelmaques.com/en/feed.json
Portuguese pages are at the same paths without /en. Sitemap: https://wendelmaques.com/sitemap.xml