Thursday, 22 October 2026

PHP2Shell: AI-found bugs that let anyone run code on WordPress

Wiz Research disclosed two memory-safety bugs in PHP’s core engine (CVE-2026-109618/-109619) that allow unauthenticated remote code execution on WordPress, Drupal and Joomla, affecting nearly every PHP version back to 5.4. Wiz credits its own Atlas tooling plus Gemini 4 Argon and GPT-5.6 Sol; Calif found the same bugs independently with GPT-5.6 Sol. Patched releases (8.5.12, 8.4.27, 8.3.36, 8.2.35) shipped 21 October after an August report.

OpenAI used the episode to propose a five-stage framework for coordinating disclosure when agents find critical bugs faster than maintainers can patch them, with $1B of subsidised access for defenders.

Wiz Research · OpenAI “Patch the Planet” · PHP Foundation

Claude hunts config flags that quietly switch off security

Anthropic’s Frontier Red Team pointed Claude at 25 open-source projects (5M+ lines) looking not for bugs but for unnecessary attack surface. It found 493 issues, including 162 security-sensitive configuration combinations — 94 of which silently disabled a security control. In OpenSSH 10.4, ~4,500 lines of ML-DSA-44 code were reachable before authentication by default; fixed across 10.5 and 10.6. The skill is released for reuse.

Anthropic (Chris Rohlf)

The agent fixed the bug. What else did it break?

Trail of Bits reviewed 130+ merged upstream PRs and confirmed 21 regressions (16 functional, 1 performance, 4 build/test) — the quiet side-effects a patch review tends to miss. They’ve released two plugins: patching-bugs for delegating fixes and regression-hunt, a deliberate adversarial pass that hunts for what the fix changed. In early tests it gave 25% fewer false positives than a baseline Codex prompt.

Trail of Bits (Naik & Morales)

Frontier models finally learn COBOL

OpenAI’s MultiLangBench asks a model to build a SQLite-compatible engine in each of 20 languages. GPT-6 Astra averages 87.4% test pass rate versus 26.8% for GPT-5.6 Sol; COBOL alone jumps from 10.9% to 72.1%. On COBOL-to-modern migration GPT-6.1 Sol hits 97.9% at high effort. The benchmark setup is going on GitHub — worth watching for the long tail of embedded and legacy languages.

OpenAI

Eight bits of trust: CA private keys equal to 4, 56 and 115

The private keys of eight eMudhra intermediate certificate authorities (P-384 curves) turned out to be tiny integers, recoverable from the public certificates in under a second. eMudhra blamed a script bug in its key ceremony. Chrome and Firefox have blocked them and Mozilla is removing the root, but Scott Helme points out that curl, Python, Node and most non-browser clients will keep trusting them by default. A one-line sanity check (“is the key suspiciously small?”) would have caught it.

Scott Helme

Claude designs protein binders against scorpion venom

An Anthropic research model ran autonomously for 64 hours, generated 318,484 protein designs and picked 211 for wet-lab testing. Seventeen bound their target, all against one toxin; the best two (Cn2-B1, B2) bind in the single-digit nanomolar range. The team is clear that neutralisation in cells or animals is untested, and has published all 211 designs and the data.

Anthropic

Voxtral 3: open-weight speech in, speech out

Mistral’s Voxtral 3 family covers transcription in 50+ languages and text-to-speech in 35+ languages and 50+ dialects, plus a LiveKit-based voice-agent SDK. Transcription starts at $0.0035/min and it can be self-deployed — handy if you ever want a talking balloon co-pilot that runs offline.

Mistral AI

A VGA driver built bottom-up in SystemVerilog

Lukas Werner’s write-up of a university lab: dividing a DE10-Lite’s 50 MHz clock to 25 MHz for 640×480@60, counting 800×525 including blanking, squeezing 2-bit channels into the board’s 4-bit DACs, then ROM-backed images and alpha-compositing experiments. A tidy refresher on how pixels actually leave a chip.

Lukas Werner

Permit Pending: SimCity, but every road needs a hearing

Peter Cai’s browser city-builder casts you as an elected mayor. Projects go through hearings, appeals, lawsuits and a seven-seat council, with elections every four years. Scenarios run from a 200-person blank slate to “The Unaffordable Metropolis” (300,000). It’s a sandbox with no win screen, and a sharp example of making friction itself the core mechanic. It topped Hacker News with nearly 900 points.

Permit Pending · HN discussion

Tao’s challenge: how small can you make the tenth discriminant?

Terence Tao proposes a crowdsourced AI-maths exercise. For each new write-up on the quasi-Riemann result or Siegel zeros, contributors use AI to extract an effective upper bound on a hypothetical tenth imaginary quadratic field of class number one, without using Heegner’s methods. A low enough bound would let a computer settle the class-number-one problem directly. The bound also gives a crude way to compare how strong the different write-ups are. AI use must be disclosed and checked by a human before posting.

Terence Tao

Mars’s 1,800 km cloud freezes out of almost nothing

Each Martian summer morning an elongated cloud streams ~1,800 km west from the 20 km-high volcano Arsia Mons. A Nature Geoscience paper led by Jorge Hernández-Bernal argues it’s the first natural case of homogeneous nucleation: gravity waves chill the air by ~30 °C in under 15 minutes to below −143 °C, and with barely any dust to seed on, the vapour freezes directly. Lovely mechanic: lee waves off a mountain painting a cloud trail.

Universe Today

The fattest belemnite: a barrel-shaped Jurassic “squid”

Wyoteuthis linsterorum, from Wyoming seas ~160 million years ago, has a rostrum about 10 cm long and 6 cm wide — the stoutest belemnite known, from an animal perhaps 60 cm long. Only two specimens exist, one found by amateur collector Cliff Linster near Ten Sleep and donated in 2019; it carries his name.

ScienceDaily (University of Manchester)

US Championship R10: So a point clear with one round left

Wesley So took a quick draw with Niemann and stays a full point ahead of Caruana and Oparin, who drew each other. Shankland beat Sevian and Aronian beat Robson. Caruana or Oparin can only force tiebreaks if So fails to win in the final round, so a fourth national title looks close. In the women’s event Rachael Li beat Atwell to lead Alice Lee by a point. Round 11 was underway at the time of writing.

Chess.com (Anthony Levin)

Austin: Mercedes bring their upgrade, Piastri sees “no magic”

Mercedes confirm both Antonelli and Russell will race the upgraded W17 and its new front wing in Austin. The package was only tested in Singapore practice; it adds downforce but has a narrower operating window. Antonelli could clinch the title there in the unlikely scenario covered yesterday. Piastri, 202 points behind after DNSs in Australia and Japan, says the MCL40 is “probably as good as it’s going to get” for now. Stella says McLaren’s upgrades will arrive in phases over the last three races.

PlanetF1 (Mercedes) · PlanetF1 (Piastri)

Reznor & Ross score Saulnier’s haunted-attraction thriller

Trent Reznor and Atticus Ross will score Jeremy Saulnier’s Slayground for A24. In it, a haunted-house “scare-actor” wakes among his dead co-workers and has to find out what happened before a statewide manhunt catches him. It stars Cory Michael Smith, Sophie Wilde and Imogen Poots, and opens in US cinemas on 29 January 2027. Also out this week: Hans Zimmer’s “Desert Chant” from Dune: Part Three.

Film Music Reporter · “Desert Chant”

Hans Zimmer live next week; 7 Bridges Walk through Pyrmont Sunday

Hans Zimmer plays Afterpay Arena, Olympic Park, Wed 28 and Thu 29 Oct (doors 6pm, show 7:30, finishes ~10:30). Trains run every 10 minutes from Lidcombe, but trackwork hits most lines overnight until ~1:30am, so allow extra time getting home. Sun 25 Oct: the 7 Bridges Walk has a village at Pyrmont Bay Park opposite The Star, 7:30am–4:30pm. The bridges stay open but footpaths will be crowded, and there are no City Circle or Central–Wynyard trains that day. Sat 31 Oct: BIGBANG at Accor Stadium, with up to 65,000 fans and heavy trackwork.

Transport NSW: Hans Zimmer · 7 Bridges Walk · BIGBANG