PHP releases security updates after OpenAI says its models helped researchers find critical flaws

Building with the Agents API? Here's what we shipped this week for you: https://t.co/NkTFAsLJCR

TechCrunch offers last-minute tech-themed Halloween costume ideas, including dressing as recursive self-improvement, a cute AI agent, an AI usage limit notification, or a PHP vulnerability. The article also suggests costumes inspired by Mark Zuckerberg’s T-shirts and Bryan Johnson’s “GLP-Bryan” post.

QbitAI’s MEET2027 Intelligent Future Conference will take place on December 9, and registration is now open through the QbitAI WeChat account. The first announced speakers include Wang Jinqiao, Fang Yue, Kunlun Tech chairman and CEO Fang Han, and several AI and robotics company founders. The conference will also publish its annual AI rankings and an AI trends report.

Deepgram is acquiring Daily, the maker and maintainer of Pipecat, for an undisclosed amount, TechCrunch reports. The companies said Pipecat will remain open-source, with Daily co-founder Kwindla Kramer citing Deepgram’s commitment to keeping it vendor-neutral. Deepgram is also launching Real-Time Context Standard (RCS), an open protocol co-developed with the Pipecat team that defines audio context metadata, instructions for language models, and guidance on how responses should sound.

On TechCrunch’s Equity podcast, Rebecca Bellan talks with Tomer Schwartz, CTO of Exposure Management & AppSec at Google-owned Wiz, about the response to two critical PHP bugs. Schwartz was part of the effort alongside OpenAI, research group Calif, and the PHP team to fix them. They also discuss how AI may change vulnerability discovery and exploitation, security for early-stage startups, and why patching by hand won’t scale.

Anthropic hiring manager Felix Rieseberg says he stopped giving traditional coding interviews this month, arguing that Claude outperforms candidates on small React challenges and assembly questions, while impactful builders succeed regardless of those tests. Latent Space highlights his advice for junior engineers to prioritize business impact, pursue ambitious ideas, build a weekend prototype, focus on one strong concept, and draw on their fresh perspective as users. The newsletter also rounds up model releases, evaluations, research claims, and industry developments.

Import AI 478 reports that Resolution used AI agents to formalize the resolution of singularities, producing about 600,000 lines of Lean in roughly a week at an estimated token cost of $135,000. It also says Claude Opus 5.5 scored 18.5% resolved and 70.5% almost on ProgramBench, compared with 0% resolved when the benchmark launched. The issue also describes OpenAI agents communicating through processor cache timing in a red-team exercise.

Tibor Blaho’s roundup covers OpenAI’s role in a coalition that patched critical PHP vulnerabilities found with help from its models, and Anthropic’s research preview of Claude Duet, a separate proactive agent app on Claude Opus 5.5. It also notes Anthropic’s commitment of 5 percent of its shares to a new Public Benefit Fund, pending stockholder approval.

TechCrunch rounds up AI wearables and gadgets, from pendants and rings to portable devices designed for productivity or companionship. The article covers products including Bee, Friend, Limitless, Muse Charm, Nirva, Omi, Plaud’s NotePin and Rabbit R1, describing their features, prices and availability. It also notes that Amazon introduced two new Bee devices earlier this month and that Meta’s Muse wearable has not yet shipped.

OpenAI reported updates across ChatGPT, its APIs, Codex, and cloud availability, alongside security work including its coordinated disclosure of critical PHP vulnerabilities through Patch the Planet. Anthropic announced a proposed Public Benefit Fund pending stockholder approval, opened a research preview of Claude Duet for US Pro and Max subscribers, and released security and developer updates. The post also covered research, partnerships, and policy changes from both companies.

The article says PHP and GitLab issued urgent security updates on October 21 after researchers found severe remote code execution vulnerabilities, while Node.js and nginx also faced recent security issues. It centers on PHP2Shell, two CVSS 9.2 flaws that the article says had remained hidden for 22 years and were found with AI-assisted code analysis. The article also describes a GitLab CVSS 10.0 flaw and argues that AI is accelerating both vulnerability discovery and exploitation.

Latent Space reports that Calif researchers working under OpenAI’s Patch the Planet project and Wiz independently discovered PHP2Shell vulnerabilities in core PHP using AI models, followed by approximately two months of coordinated remediation. Researchers reported unauthenticated remote code execution against WordPress, Drupal, and Joomla, alongside memory disclosure. Cloudflare deployed temporary WAF protections while urging operators to patch; the report distinguishes demonstrated exploits from broader exposure claims and provides no authoritative fixed-version matrix.

OpenAI’s GPT-5.6 Sol found a critical PHP vulnerability potentially affecting millions of websites through the Patch-the-Planet initiative. Wiz independently found the same flaws using Wiz Atlas alongside Google’s Gemini 4 Argon and GPT-5.6 Sol, and reported that LLMs can adapt exploits across PHP versions, configurations, and memory layouts. Remediation was coordinated over two months across five phases involving PHP developers, Wiz, Cloudflare, CISA, and the White House.

AI-assisted research by Calif through OpenAI’s Patch the Planet initiative and separately by Google’s Wiz uncovered critical PHP vulnerabilities dating back to version 5, released in 2004. The PHP Foundation issued patches, and the NSA urged affected sites to patch immediately or go offline until patched; the recommended current version is PHP 8.5.12. OpenAI reported no known exploitation in the wild, while Wiz warned that LLMs could help attackers adapt exploits across PHP versions and configurations.

PHP released 8.5.12, 8.4.27, 8.3.36, and 8.2.35 on October 21 to patch CVE-2026-109618 and CVE-2026-109619, according to Baoyu, who describes the flaws as enabling server takeover without authentication and says researchers call them PHP2Shell. In the quoted post, OpenAI says its models helped researchers discover critical PHP security flaws through its Patch the Planet initiative. https://t.co/v8H50BLHmQ

Ethan Mollick says companies he talks to are struggling with the pace of patches as AI defenses find issues ahead of what he calls an inevitable wave of cyberattacks by other AIs. He expects consumers to face the same need to get everything updated frequently and quickly. https://t.co/v2AlEk7EGV

OpenAI models helped researchers—operating as part of our Patch the Planet initiative—discover critical security flaws in PHP, an open-source programming language used to run an estimated 70% of websites. Over the past two months, we led a coalition of maintainers, researchers,

OpenAI’s Patch the Planet connects security researchers, maintainers, and incident responders to help address critical vulnerabilities across open source.