This week in AI: AI finds a decade-old hole in PHP

Good morning,

AI found a serious flaw in the software behind most websites, a Chinese model got within three points of the best AI you can buy, and every big lab now has an agent that works while you sleep.

AI found a decade-old hole in the language behind most websites

Researchers using AI found two critical flaws in PHP, the language that runs WordPress, Drupal and much of the web. PHP released fixes on Wednesday.

• The risk: an attacker can take over a server with no login, or read passwords and API keys from its memory.
• Who found it: Wiz found both flaws using Gemini 4 Argon and GPT-5.6 Sol. Calif found one separately with GPT-5.6 Sol through OpenAI's Patch the Planet program.
• The response: the US cybersecurity agency CISA told organizations that cannot update to take PHP systems offline. Some government sites went dark.

The bugs sat in PHP for over a decade. Wiz says AI made the complex exploit practical.

The caveat: working attacks are still hard. Millions of attempts have followed disclosure, and most fail on standard setups. But Palo Alto Networks confirmed one break-in at a European government body, where attackers reached password hashes within two hours.

Expect more. OpenAI says it is already fixing other serious flaws. Cloudflare CEO Matthew Prince says he knows of more severe bugs in other critical software, and expects "a couple years where every single week it's going to feel like the sky is falling."

If you run a PHP site, confirm today that your host moved you to 8.5.12, 8.4.27, 8.3.36 or 8.2.35. PHP 8.1 and older get no official fixed release.

Kimi K3.1 Pro gets close to the top, with free weights promised

Chinese AI lab Moonshot released Kimi K3.1 Pro on Friday. It is the strongest model anyone has promised to let you download.

• Independent score: Artificial Analysis puts it fourth at 55, behind Claude Opus 5.5 (58) and ahead of GPT-6 Astra and Gemini 4 Argon.
• Price: $2 input and $10 output per million tokens, half the price of Opus 5.5.
• Weights: not out yet. Moonshot says they arrive by November 4.

Early reports on Hacker News share one complaint: Kimi's subscriptions run out fast. One user on the $99 plan hit the five-hour limit in 47 minutes.

If you need open weights today, DeepSeek's V4.1 Flash 1017 is already downloadable under the MIT license and scores 45, at a fraction of Kimi's price.

Use Kimi through the API, not the subscription. Self-hosters should check the license on November 4.

Every big AI lab now has an agent that works while you're away

Anthropic opened a waitlist for Claude Duet on Wednesday. That completes a set: SpaceXAI's Grok Bot arrived in August, followed by Meta's Muse and OpenAI's Dots in September.

All four get their own cloud computer, sign in to your apps, keep working after you close the laptop and ask before risky actions.

They differ in who they are for:

• Duet: work and small business, such as invoices, contracts and a morning brief. US Pro and Max only, and background checks count against your limits.
• Dots: teams already in ChatGPT, Slack or Teams. Needs Pro or Business Premium.
• Muse: everyday personal tasks, with a free tier and WhatsApp access.
• Grok Bot: SuperGrok and Cursor subscribers, with its own usage allowance.

The caveat: no independent test yet compares how often they finish a job, and Anthropic warns Duet can misjudge urgency.

Pick the one inside tools you already pay for, and start with read-only jobs like a daily brief. If you would rather run one on your own server, open-source agents such as Hermes Agent do similar work with more setup.

Quick hits 🗞️

• LiteLLM, a popular tool for routing AI requests, shipped malware. Version 1.107.0 stole credentials for about two hours on Wednesday. If you installed it, pin 1.106.2 and rotate every key that machine could reach. Source

• Google may now use connected Gmail and Photos data for ads. Google says ads are not based directly on your inbox. You can disconnect apps in settings. Source

• OpenAI's models are coming to Google Cloud. GPT-6 Astra, GPT-6.1 Sol and Luna are in private preview for selected companies, billed through Google Cloud. Wider availability is planned within weeks. Source

• OpenAI now trains its strongest models offline. An internal model reached the internet through a misconfigured server in September, pausing major training for 11 days. Source

• Jack Dorsey's Block showed Dessa, a voice AI trained only on recorded speech. It listens and talks at once, and Block says it runs on a high-end MacBook. So far there is only a waitlist and Block's own clips. Source

Model leaderboard 🏆

Intelligence Index via Artificial Analysis, which tests models independently.

Claude Opus 5.5 · Anthropic
58
Claude Sonnet 5.5 · Anthropic
56
Muse Wonder Full · Meta
56
Kimi K3.1 Pro · Kimi
55
Claude Fable 5.1 · Anthropic
53
GPT-6 Astra · OpenAI
53
Gemini 4 Argon · Google
53

Best value: Claude Haiku 5.5 (43) at about $0.20 per million tokens. Best open-weights: Xiaomi's MiMo-V2.6-Pro (46), free to download. Moved this week: Kimi K3.1 Pro entered in fourth place.

 

See you next week!

If this helped you catch up quickly with AI, forward it to someone who would find it useful. They can subscribe here.