Critical PHP flaws expose majority of web infrastructure to AI-driven attacks
Security researchers disclosed a critical PHP vulnerability allowing remote code execution without login, affecting up to 70% of websites. The incident triggered a global security response, with the NSA advising organizations to take systems offline until patched.
A critical vulnerability in PHP, dubbed 'PHP 2 Shell' by some researchers and 'PHP to Shell' by others, allows remote code execution without authentication. The flaw impacts all PHP versions from the past 20 years, affecting approximately two-thirds to 70% of active websites worldwide. Discovered two months ago using AI models, including OpenAI’s GPT-5.6 Sol and an autonomous system by Wiz, the bug was identified independently by a researcher at Calif and by Wiz, a Google subsidiary. Volker Dush, a security engineer at the PHP maintainer, described it as the most severe issue in over a decade, comparing its impact to Heartbleed.
Knowledge of the exploit spread ten hours before public disclosure, prompting the NSA to advise organizations to take systems offline until patches were applied. Cloudflare CEO Matthew Prince reported thousands of exploitation attempts in the ten hours pre-announcement, rising to millions shortly after. In Germany, the City of Mainz, the Federal Ministry of the Interior, constitutional protection agencies, hospitals, and airports temporarily took websites offline. Cloudflare CTO Dan Knecht confirmed immediate attacks following the patch release. The incident has driven stock gains for security firms, with Cloudflare shares rising nearly 7%, Palo Alto Networks 4%, and CrowdStrike 3%. OpenAI President Greg Brockman stated that the industry is entering a new phase where models find internet-scale vulnerabilities, suggesting authorized defenders may need to remotely patch systems to match the speed of AI-driven attacks.
Anthropic faces cloud capacity shortages ahead of potential November IPO
A leaked S1 filing reveals Anthropic is struggling to secure cloud capacity from major providers. The company is leasing its own data centers to mitigate scarcity as it targets a November IPO.
Meta launches non-voting shares to fund expanded AI infrastructure spend
Meta introduced a new class of non-voting stock to raise capital for its AI expansion without diluting founder control. The move accompanies a revised data center budget of up to $145 billion for the year.
Walmart opens platform to third-party AI shopping agents
Walmart will allow third-party personal agents to access its platform next month, a strategic pivot from its proprietary Sparky agent. The move aims to capture high-value agentic shoppers, with data showing Sparky users have order values 40% higher than non-agentic shoppers.
Venture capital concentrates in mega-deals, leaving mid-tier startups unfundable
Large venture funds now require billion-dollar positions, excluding many high-growth, profitable companies from funding. Seed round entry prices have risen, making it difficult for early-stage investors to generate returns.
- Modal raises $750 million Series D at $15.75 billion valuation
- A16Z expands crypto fund into A16Z Frontier for emerging tech
- Resend reaches 100,000 paying customers amid AI-driven adoption
- Insomnia Cookies CEO outlines strategy to reach 1,800 global bakeries
- Moshi processes 300 data points per second for traders
Modal deploys AI agents for internal defensive security testing
Following a security incident involving a customer application, Modal has implemented stricter default security restrictions and begun using AI agents to probe its own systems for vulnerabilities. The company aims to reduce the frequency of human penetration testing from every six months to once a year.
Modal sandboxes drive one-third of revenue from agentic workloads
Modal’s sandbox infrastructure now accounts for roughly a third of its revenue, growing 30% month-over-month. The company is shifting toward ephemeral, virtualized environments to support high-volume agentic workflows.
- Magic Patterns releases Magic OS canvas for AI design workflows
- Resend optimizes API and CLI for AI agent consumption
- WorkOS builds identity and authorization layers for AI agents
- Docker defines maturity levels for agentic coding adoption
- Experts critique vibe-coded startup landing pages for poor conversion
Meta beats earnings, raises capex guidance amid AI expansion
Meta reported strong Q3 revenue and launched its Muse AI agent, which has gained over 10 million users. The company raised its full-year capital expenditure guidance to $135 billion to $145 billion.
- Musk considers merging Tesla and SpaceX into single entity
- Musk confirms committees reviewing potential Tesla and SpaceX merger
- Bitcoin stalls near $85,000 as macro liquidity risks persist
- CoreWeave shares drop 20% on concerns over high debt load
- Copper prices hit record highs on AI demand and supply deficits
JP Morgan adds Bitcoin to long-term forecasts, predicts 10% annual return
JP Morgan projects a 10% annual return for Bitcoin over the next decade, exceeding expected returns for stocks, bonds, or gold. The bank excluded the asset from standard portfolios due to high volatility.
AI disrupts the internet's distribution covenant and media models
Chris Dixon argues that AI is breaking the historical deal between platforms and creators, causing traffic drops for sites like Stack Overflow. He predicts a decade-long reconfiguration of internet economics and the rise of AI-native media forms.