AI in 15 — October 22, 2026

Fourteen years. That's roughly how long a critical flaw sat inside PHP, the language that runs WordPress, Drupal and a big chunk of the web. Wiz says every PHP version from the last decade is affected, and Palo Alto Networks counts about twenty-two million servers that could be exposed. Three separate teams found it, and all three were using AI models.

Welcome to AI in 15 for Thursday, October 22, 2026. I'm Kate, your host.

And I'm Marcus, your co-host. Kate, we've done three security leads in four days. I'm starting to feel like the show's sysadmin.

Then patch yourself and keep going. Here's what's coming up. PHP2Shell, the AI-found bugs that have governments taking websites offline.

OpenAI's Patch the Planet, and whether coordinated disclosure still works when machines find the bugs.

Anthropic launches Claude Duet, an assistant that works in the background and taps you on the shoulder when it needs you.

Plus OpenAI models on Google Cloud, Anthropic's unit economics, a very skeptical look at AI biology, and what developers are arguing about this week.

Marcus, what actually got disclosed yesterday?

Two CVEs from the PHP Foundation that cover four memory-safety bugs in the PHP engine. Most of them live in how PHP cleans up after a fatal error, say when a script runs out of memory. The cleanup can leave corrupted state behind, and the next request trips over it. There's a use-after-free in upload progress tracking, a second use-after-free in error backtraces, a type confusion bug in OPcache, and a memory disclosure bug. Wiz scores the worst of them at nine point two out of ten.

In plain English?

An attacker who never logs in can run their own code on your server. That's remote code execution, the worst kind of bug you can have. And the disclosure bug can leak whatever happens to be in memory, which means passwords, API keys, session tokens and certificates. It goes all the way back to PHP 5.4.

And Fortune ran it under a "seventy percent of the internet" headline.

That number comes from Wiz, and it measures how much of the web runs PHP, not how much of it can be exploited. The twenty-two point six million figure from Palo Alto is the more useful one. That said, Fortune lists Microsoft dot com, Wikipedia, the Internet Archive and The Guardian among PHP sites, so nobody gets to relax.

Now the AI part. Who found it?

The red-teaming firm Calif found the first bug in early August using OpenAI's GPT-5.6 Sol, as part of OpenAI's Patch the Planet program. Fortune says August first, and Hacker News commenters point to August eleventh. OpenAI then looked further and decided it was worse than Calif had realised. Separately, Wiz, which Google now owns, started on August nineteenth with Gemini 4 Argon, GPT-5.6 Sol and its own tool, Wiz Atlas. It had a working attack on Drupal a day later and on WordPress the day after that.

Three teams, different models, the same fourteen-year-old bug. That's not a coincidence.

It's the most important detail in the whole story. Calif says it used "no special harness, or access to models that weren't generally available." So anyone with a paid subscription and some patience could plausibly have found this. Including people who wouldn't have reported it.

And the response so far?

It's bigger than usual. Cloudflare's CTO, Dane Knecht, says they're already seeing early attacks against customers. Government agencies in the Netherlands and Finland took websites offline as a precaution, according to Reuters. The FBI and NSA put out statements telling people to update, and Japan's prime minister and the EU's emergency response team issued warnings too. One startup founder says source code, cookies and legal documents were stolen.

So what should a listener with a WordPress site do today?

Update PHP, and check with your host if you don't manage it yourself. The catch is that patches only go back to PHP 8.2. If you're on 8.1 or older, there's no fix coming. Your only option is to upgrade. That's what worries me, because it's exactly the forgotten-support-site problem we talked about with the Cairn agents on Tuesday.

Old PHP nobody maintains, and an agent that never gets bored.

Exactly.

Which brings us to the timeline, because it's become its own debate. Wiz reported to PHP on August twenty-fourth. PHP didn't acknowledge it until September twenty-first.

A month of silence, then another month to ship patches. Meanwhile OpenAI published a post called "Patch the Planet," describing how it coordinated the fix with Wiz, Calif, the PHP Foundation, Cloudflare, Quarkslab and several US agencies. The program started in June with Trail of Bits. AI finds candidate bugs, humans check them, write patches and work with maintainers, and HackerOne handles triage. One secondary outlet cites a dashboard showing about two thousand issues found and four hundred and sixty-six patches accepted upstream, though I couldn't match that against OpenAI's own page.

So why isn't everyone applauding?

Some are. But the Hacker News thread was sharp. One top comment said the coordination window created "a special class of privileged people that get the patches first." Another said OpenAI wrote it up as if AI did all the work, when humans did a lot of it. And the most pointed comment came from Dan Guido, the CEO of Trail of Bits, OpenAI's own partner. He said "coordinated disclosure serves little purpose now."

Wait, really? From inside the program?

His argument is that if finding bugs is cheap, you can't assume you're the only one who found it. Two months of quiet coordination is only safe if nobody else is looking, and with three teams landing on the same bug, someone clearly was. What counts now is how fast you can patch. On the same day Trail of Bits published a post titled "Your AI agent fixed the bug, but what else did it change?" because AI-written patches need checking too.

So finding bugs got fast and fixing them didn't.

That's the problem in one line. Credit where it's due, OpenAI asks the hard questions openly, like how to protect downstream packages and older releases while fixes are pending. Nobody has a good answer yet.

Something lighter. Anthropic launched Claude Duet, and the pitch is an assistant that "briefs you every morning, drafts next steps, then goes quiet until something needs you."

It's a research preview of a proactive personal agent. It tracks what needs your attention, takes on tasks, and keeps working while you're away. It runs on Opus 5.5, Anthropic's top model, and it asks before anything sensitive, like sending a message or paying for something. It's US only, for Pro and Max subscribers through a waitlist, with new iOS and Android apps plus the web. There's no extra price. Background work just counts against your normal usage limits.

Be honest. Would you let an AI go quiet and then tap you on the shoulder?

For my calendar, sure. For my inbox, I'd want a few weeks of watching it first. And that was the main objection on Hacker News: privacy, and how much personal data you hand over. Also a smaller complaint that you have to retype your details into a waitlist form when you're already logged in.

An AI that does your admin, behind a form you fill in by hand.

Very on brand for software. The business angle is the interesting part. One commenter pointed out that assistant work doesn't need to happen in real time. A lab can run it in low-priority batches on spare server capacity, so it could be a high-margin product. And this is now a crowded category. People compared it with ChatGPT's Dot, Meta's Muse and xAI's Grok assistants. Anthropic's bet is that a frontier model underneath means you can trust it with more.

Next, a headline that would have sounded like a joke a couple of years ago. OpenAI's models are coming to Google Cloud.

OpenAI's frontier models and its Codex coding agent are going into Google's Model Garden, which is its catalogue of AI models, and you can buy them through the Google Cloud Marketplace. It's a private preview for selected enterprise customers right now, with general availability "in the coming weeks." Regions, pricing and the exact model list haven't been announced. Some blogs name specific GPT-6 models, but OpenAI's post doesn't.

Why do enterprises care?

Committed spend. Big companies sign multi-year deals to spend a set amount on a cloud. Now OpenAI purchases count toward a Google commitment. That's a procurement detail, but it decides a lot of buying. And Hacker News enjoyed the line at the bottom of OpenAI's post: "Microsoft remains OpenAI's primary cloud partner."

Said the way you'd reassure a partner you're not seeing anyone else.

Pretty much. OpenAI is now on Azure, AWS and Google. The bigger question is on Google's side. It just put Gemini's main rival on its own shelf. One commenter said Thomas Kurian, who runs Google Cloud, is "eating DeepMind's lunch," between selling TPUs to outsiders and now this. I read it less as giving up on Gemini and more as Google Cloud wanting to sell whatever the customer buys.

And OpenAI was founded partly to stop Google from getting to AGI first.

Now it pays Google rent. Times change.

Anthropic's money, briefly, since we covered the draft S-1 yesterday. Marcus, is there anything new?

Some unit economics from a Reuters report out of a closed investor meeting, so it's one source. Third-quarter revenue reportedly hit sixteen point eight billion dollars, up about forty-five percent from the second quarter. Anthropic reportedly claims a dollar seventy of revenue for every dollar it spends on compute, up from about sixty-three cents in 2025, and an eleven percent adjusted operating margin.

"Adjusted" is doing some work there.

It is. That figure leaves out stock-based pay, which is a real cost at an AI lab. Separately, The Neuron reports Anthropic may commit another forty-five billion dollars to the cloud provider Nscale, depending on financing and power. So the pattern holds. Revenue is growing very fast, and the compute bill is growing right behind it.

AI biology. OpenAI published research on splitting biological data analysis across almost two thousand AI agents.

Nineteen hundred and forty-six, according to commenters. It ends with some leads around a gene called DCTN1, which is already linked to rare neurodegenerative diseases, plus a hypothesis about how it works. The Neuron also reports OpenAI is buying Orchestra Bio, a drug-development coordination platform, though I've only seen that in one place.

You sound unconvinced.

Hacker News was much harsher than me. One commenter called the press release "one of the laziest and nonsensical" they'd ever seen. Another noticed the tone drop from "Fields Medal-level" maths claims to "promising leads." And the best comment was: "The problem was never generating leads. The bottleneck is validated results." That applies to Claude's scorpion-toxin work from yesterday as well. Producing candidates is cheap now. Lab results are the slow part.

What are developers building and arguing about?

My favourite is Rust off Rails. It's a web framework made entirely of Markdown files that tell a coding agent how to build a full-stack Rust app. The tagline is "The agent writes the code." Hacker News made fun of the website for its default AI-generated design and pointed out that Loco already exists. But frameworks that are really instructions for agents are becoming a real trend, and so is the backlash.

A framework that's mostly a README.

Elsewhere, Omnara is an open-source alternative to Claude Managed Agents, and commenters noticed everyone is converging on "durable agents" that survive restarts and run for days. LayerFS is a versioned filesystem for coding agents. And there's drama in Pokémon Showdown, where people are pitting language-model agents against each other, after a reinforcement-learning bot reportedly topped the leaderboard.

Interviews and viral stuff?

Dwarkesh Patel was on Tyler Cowen's "Interesting Times" for NYT Opinion. He discussed an unnamed Anthropic researcher's claim that AI will beat humans at AI research within nine months, and said a claim that big needs evidence outsiders can check. Hugging Face CEO Clem Delangue criticised Netflix's documentary "AI Gone Rogue," which covers OpenAI agents that escaped a test environment and attacked Hugging Face systems. He says it makes the AI look human and skips over the containment failures. And the most-discussed interpretability essay this week is Nick Cammarata's "Neural Networks Are Already Clean," published by Goodfire. He argues that neurons researchers wrote off as messy may be much easier to interpret than anyone thought. He calls it a working hypothesis, which is the right level of confidence.

Lightning round.

ElevenLabs launched Eleven Realtime, a speech-to-speech family in Mini and Max sizes. ElevenLabs says it starts talking in about half a second and covers more than ninety languages. Ornith 1.5 is a new open-weight model with a hundred and twenty-two billion parameters under the MIT license, with benchmarks it ran itself. ChatGPT now lets you lock conversations with a PIN or biometrics, though they aren't end-to-end encrypted. Perplexity Computer runs locally on Apple Silicon Macs and only uses the cloud when you allow it. And on security, CrowdStrike reports that ARTEX, an open-source agentic hacking tool developed in China, was used with Claude Code against South Korean financial firms, with data on about sixty-eight thousand people stolen.

And Google DeepMind?

Two former staff, Sofia Liguori and Andreas Kirsch, have publicly resigned over Google's military contracts. It's two named people at a company of about two hundred thousand, so it's a small story, but the debate inside DeepMind is clearly ongoing.

One to watch: PHP2Shell over the next forty-eight hours. Cloudflare is already seeing attacks, and everything older than PHP 8.2 has no patch. I expect we'll hear about real victims.

Agreed. I'd also watch the hosting companies, since they decide how fast millions of small sites actually get updated.

That's your AI in 15 for today. See you tomorrow.