AI Cracks PHP Under 70% of the Web, Claude Gets a Duet & OpenAI Moves Into Google Cloud
Dispatches of the past four-and-twenty hours from the laboratories of artificial intelligence
Security
AI Finds a Hole Under Seventy Per Cent of the Web
PHP2Shell: two critical flaws in the PHP engine itself, found with frontier models, fixed in secret over two months and now patched
By Our Locksmith Correspondent
PHP runs an estimated 70% of the world’s websites, from WordPress to Wikipedia. Yesterday its maintainers shipped emergency fixes for two critical flaws, nicknamed PHP2Shell, that let an attacker take over a web server without logging in. OpenAI says the research firm Calif found one of them with GPT‑5.6 Sol under its Patch the Planet programme, and that Wiz independently found and reported both. Google says Gemini 4 Argon helped Wiz find the bug, build the exploit chain, write detectors and check the patch.
Both flaws come from the same weakness: when a request ends abnormally, PHP can leave its memory in a corrupted state that the next request then trusts. Every PHP version of the last decade, back to 5.4, is hit by at least one of them, and each carries a severity score of 9.2. OpenAI led a coalition of maintainers, researchers and providers such as Cloudflare for two months, because the fix needed a major change to the PHP engine. It calls this one of the most impactful vulnerabilities in recent memory, and proof that AI can now find bugs with internet-scale impact.
The fix is to upgrade to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35; version 8.1 and older get no official patch. OpenAI also published a free checker, which can run as a Codex skill, that reads a site’s PHP version and answers OK, VULNERABLE or UNKNOWN. Its own README warns that UNKNOWN does not mean safe.
A proactive agent app that briefs you each morning, works on its own computer while you are away, and asks before it acts
By Our Correspondent at the Elbow
Anthropic opened a research preview of Claude Duet, a separate app in which Claude works as a proactive agent. It sends a short morning brief from your connected apps, checks them every few hours, messages you only when something needs you, and takes on tasks from scheduling to sales forecasts and small web apps. It runs on Claude Opus 5.5, carries over your memory, skills and connectors, and works on its own virtual machine with a browser, so your laptop can stay shut.
Before it sends a message, pays, signs or deletes anything, it shows exactly what it will do and waits for approval. A new classifier blocks sharing card numbers and ID documents. Access is by waitlist for Pro and Max users in the US, and Anthropic admits it can still misjudge what is urgent. OpenAI’s Codex chief Tibo Sottiaux replied: “Dot, meet Duet. Duet, meet Dot. Be nice to each other.”
GPT models and Codex workflows arrive in Google Cloud’s Model Garden
By Our Real-Estate Correspondent
OpenAI is bringing its frontier models and Codex agent workflows to Google Cloud’s Model Garden, so companies can use them where they already build. Google Cloud says it is now the only hyperscale cloud offering all three leading closed models, alongside more than 200 others, on one enterprise platform. Sundar Pichai reposted the news, which came on the same day as a long interview about Gemini 4 Argon and the compute crunch.
GPT-Rosalind points at cholesterol in a rare brain disease, and a Gemini pipeline finds 20 new mathematical “Cryptids”
By Our Laboratory Desk
With Perturb and Scripps Research, thousands of GPT-Rosalind agents worked in parallel for 32 minutes, matching gene data from millions of mouse brain cells with the literature. One lead: disrupting DCTN1, a gene linked to the rare Perry syndrome, raised cholesterol-making genes, and the model suggests cholesterol may simply not reach where neurons need it. Another: in one group of cerebellar neurons, disrupting TSC2 changed dozens of genes while TSC1 changed little, a possible clue to why TSC2 mutations cause worse tuberous sclerosis. These are hypotheses to test, not treatments.
At Google DeepMind, student researcher Marco built a Gemini 4 Argon pipeline for the hunt for the sixth Busy Beaver number. It studies tiny Turing machines, guesses their rules and proves them in Lean 4. It found 20 new candidate “Cryptids”, machines whose halting depends on unsolved number puzzles, and verified 33 more. All proofs were shared with the community.
Claude’s API Gets Its First New Version Since 2023
Temperature and friends are gone, and Claude Security now re-scans your code every time it changes
By Our Plumbing Correspondent
Anthropic released API version 2026-10-21, its first official version since 2023, with new major versions of its SDKs and the ant command-line tool. The temperature, top_p and top_k settings are removed from the Messages API, and a few old fields are replaced. The 2023 version is not deprecated, and Anthropic plans more frequent versions so developers can handle breaking changes before a new model forces them.
Claude Security, now in public beta on Claude Enterprise, connects to your repositories, runs a deep first scan and then re-scans as changes land. When a fix ships, even one made outside the tool, Claude marks the finding fixed, and it reopens if the bug returns. Each project gets an editable threat model, and eligible organisations get $25,000 in usage credits a month for two months.
An LLM orchestrator guesses what you might need, an auction picks the ad, and the answer never waits for it
By Our Commercial Correspondent
OpenAI explained how ChatGPT chooses ads. A post-trained model, the orchestrator, turns a conversation into several possible needs. Embedding search finds candidate ads, eligibility and relevance checks narrow the pool, and an auction tool sets the final pick and price. Ads appear below the answer, labelled as sponsored. If an ad arrives after the answer is finished, it is simply not shown for that turn, so the answer never waits for an advertiser.
The ads orchestrator: one post-trained model, six delivery tools, and a balance between user and advertiser value.מתזמר הפרסומות: מודל אחד, שישה כלים, ואיזון בין טובת המשתמש לטובת המפרסם.Image: תמונה: @OpenAIDevs on XScoreboards
Doctors’ Files, Flattery and a Magic Square
A medical tie at the top, the oldest models flatter most, and four models hide a Gaudí puzzle in their 3D scenes
By Our Tally Clerk
Artificial Analysis updated MLCR-AA, its board for Wisedocs’ medical long-record reasoning test, and Claude Sonnet 5.5 and GPT‑6 Astra now tie for first at 41.7%. Anthropic models give the most complete answers, OpenAI models the most accurate ones. Its personality benchmark found the three oldest models measured, GPT‑4o, Llama 4 Maverick and GPT‑3.5 Turbo, the most sycophantic, while Gemini models are the most confident and the least likely to admit doubt. Devin Fusion, pairing Opus 5.5 with a cheaper GPT‑6 Luna sidekick, scores 68 on the Coding Agent Index, two points above Claude Code at 31% lower cost per task, and Ramp says Gemini 4 Argon leads its accounting benchmark at 61.1%.
And a curiosity: asked to build 3D scenes of Barcelona, four models, offline and unprompted, added the magic square that sculptor Josep Maria Subirachs carved on the Sagrada Família. Claude Fable 5.1 and Sonnet 5.5 showed it openly; Grok 4.7 and Step 5 Preview tucked it behind a pillar.
MLCR-AA: Sonnet 5.5 and GPT‑6 Astra tie at 41.7%; below, score against cost per task.MLCR-AA: Sonnet 5.5 ו־GPT‑6 Astra בתיקו של 41.7%; למטה, ציון מול עלות למשימה.Image: תמונה: @ArtificialAnlys on XVoice & Video
HeyGen Takes Both Top Voices
Voice Turbo leads the speech arena at $4 per million characters, Video 1 costs a cent a second, and Voxtral hears Gustave Eiffel
By Our Wireless Correspondent
Two weeks after HeyGen Voice reached first place, HeyGen Voice Turbo has taken it over on Artificial Analysis’s Controlled Voice arena, with the older model second. At $4 per million characters it is the cheapest on the board, and the Turbo endpoint is free until November 30. HeyGen also launched Video 1, which turns a prompt or photo into a 2K clip with sound in under a minute for $0.01 a second, and both models are now on fal and in ComfyUI.
Elsewhere in audio, a tester ran Mistral’s new Voxtral transcription model on a noisy 1891 phonograph recording of Gustave Eiffel; it matched 100 of the 107 words in the national archive’s published excerpt. MiniMax paired its M3.1 Flash with SGLang Omni for voice agents you can interrupt and redirect mid-task.
Reports, memos and dashboards you edit together, or let the bot keep up to date; someone already put Doom on one
By Our Stationery Correspondent
Grok Bot can now build pages: ask for a report, memo or dashboard, then edit it together or have the bot keep it current. It is rolling out on the latest mobile and desktop apps. @ericzakariasson says he uses pages for launch burn-down lists, design docs, morning briefs and a weekly “what did I get done”, built a landing page for the feature with the feature itself, and confirmed that, yes, you can play Doom on a page.
Plus a beating heart in 3D, and Sundar Pichai admits even Google cannot get enough compute
By Our Furnace Correspondent
Google’s @OfficialLoganK says Gemini 4 Argon processed about 25 trillion tokens in its first 72 hours. T3 Code’s @theo posted that its users processed about 36.5 trillion in the same window, 1.5 times all of Argon’s demand. Google DeepMind showed Argon combining three open datasets into an interactive 3D anatomy model where you can isolate muscles or zoom inside a beating heart. In a new interview with @alexeheath, Sundar Pichai talks about Argon’s reception, where it still needs to improve, and a compute crunch that reaches even Google.
Zuckerberg talks up revenue per user, and Meta puts $1M behind an open-weights hackathon
By Our Menlo Park Correspondent
Meta’s Muse AI app passed 10 million US downloads in 40 days, a pace Polymarket says only 11 apps have matched; Alexandr Wang reposted it. On Meta’s earnings call, Mark Zuckerberg said Muse could earn more per user than Meta’s family of apps. Meta for Developers launched a Global AI Developer Hackathon with Fireworks, Baseten and Modal, with $1M in prizes for building on the open Muse Glimmer and Muse Spark Open models. At the Connect hackathon, developers had 90 minutes with Muse Code to build web apps for Ray-Ban Display glasses.
Flint Sparks on a Laptop, Hermes Closes Jensen’s Show
A fast local coding model from Richard Socher’s lab, and Nous’s agent as the finale of NVIDIA’s Berlin keynote
By Our Workshop Correspondent
Recursive, Richard Socher’s company, released Flint, its first model: an open, roughly 40-billion-parameter mixture-of-experts model for fast agentic coding on your own machine. It runs at over 125 tokens a second on an M4 Pro MacBook Pro and over 150 on an RTX Spark, was built in under four months with the lab’s automated “Eureka Machine”, and is already on Ollama.
Jensen Huang closed his GTC Berlin keynote with Hermes Agent, installing and customising it in one prompt with the line that the way to build an agent is to ask an agent. Nous also added an official Meshy plugin for making 3D models from words or photos, and Krea 3 image editing to Nous Portal.
Codex Grants Go Pro, a Physicist Joins a Trust & IKEA Goes 3D
Plus Mistral and NVIDIA in the factory, Karpathy on strange chains of thought, and a French fork of Battle Drones
Roundup from the Wire
All 10,000 grants in this round of Codex for OSS are being upgraded to the Pro 200 tier, and applications are still open. Anthropic published its annual Public Benefit Report, and physicist Christopher Stubbs, a former Harvard Dean of Science, joins its Long-Term Benefit Trust. Mistral and NVIDIA announced work on AI for industrial engineering: faster simulation, open physics benchmarks and tests for agents in engineering software. Andrej Karpathy, looking at a model’s reasoning trace, quipped that you can tell reinforcement learning is done properly when models stop thinking in English.
A French fan forked Simon Willison’s Claude-built browser strategy game Battle Drones into Panache, a Belle Époque version with dirigibles and a walking steam fortress, a day after he open-sourced it. Someone used Opus 5.5 and Jig to turn 20 IKEA manuals into free 3D assembly guides. And stalemap, a new open-source tool, tells coding agents which dependencies changed after their training cutoff.
Wren & Robin read you this morning's dispatches, with banter.
Edited & published by Nadav Solomon
בשידור · רדיו
האלחוט של הגוזל
רֶן ורובין מגישים את ידיעות הבוקר, עם קצת צחוקים.
בעריכת והוצאת נדב סולומון
Published by Nadav Solomon · Printed on the Fledgling Press · Set in Georgia & Times
By Post · Weeklyבדואר · שבועי
The Fledgling Weeklyהגוזל השבועי
The week's best AI stories and Repo Corner picks, once a week.מיטב ידיעות ה-AI של השבוע ובחירות פינת הריפו, פעם בשבוע.
Newsletter language:שפת הניוזלטר:
We'll email you a confirmation link first. Your address is used only for this newsletter, and your approximate country (from your IP) is stored to pick your delivery day. Never shared; every issue has a one-click unsubscribe.קודם נשלח לך קישור לאישור. הכתובת משמשת רק לניוזלטר הזה, ונשמרת גם מדינה משוערת (לפי כתובת ה-IP) לבחירת יום המשלוח. לא מועבר לאף אחד, ובכל גיליון יש הסרה בלחיצה אחת.
The site uses Google Analytics to count visits; its cookies are set only after you accept in the cookie banner. Privacy policy.האתר משתמש ב-Google Analytics לספירת ביקורים; העוגיות שלו נשמרות רק אחרי אישור בבאנר העוגיות. מדיניות פרטיות.
