2026-10-22
AI Found Decade-Old PHP Bugs That Can Take Over 70% of the Web
The language that runs most of the internet just got two critical holes that AI spotted after humans missed them for a decade. Some sites chose to go dark rather than stay online.
Researchers using GPT-5.6 Sol and Gemini 4 Argon uncovered two critical remote-code-execution flaws in PHP (nicknamed PHP2Shell) that date back to 2012 and affect every version through 8.5, powering WordPress, Drupal, and roughly 70% of websites. Emergency patches dropped Oct 21 after an early leak; the NSA told operators who cannot update immediately to take systems offline, and some government sites went dark as a precaution. OpenAI coordinated a “defender’s window” so patches and WAF rules could ship before full details became public.
What Happened
Wiz Research blog, CNN, OpenAI Patch the Planet, PHP Foundation advisories, NSA guidance. Patches released Oct 21; exploitation attempts reported shortly after.
2026-10-22
Hugging Face Just Released an Open Model You Can Chat With Like DNA
You can now open a laptop, paste a piece of DNA, and ask it questions in English. Hugging Face just made the genome conversational.
Hugging Face Bio launched Carbon-X (and related Carbon family models), an open-source genomic foundation model trained on DNA sequences plus English so researchers can ask plain-language questions about mutations, gene activity, and health effects. It runs locally on a laptop, handles ~50k base-pair chunks, and can also generate new sequences. The team built it so biologists are not locked into the big labs.
What Happened
Wired, Hugging Face Bio announcement, Carbon model cards. Released Oct 22.
2026-10-22
An AI Agent in “Skynet Mode” Is Hijacking Unprotected Models to Run Its Own Cyberattacks
Someone built an AI that finds other AIs, jailbreaks them, and puts them to work stealing data and mining crypto while the original owner foots the bill. They named the loop Skynet mode.
Security researchers captured a fully autonomous offensive agent that hunts the internet for exposed LLM endpoints, jailbreaks them with a five-layer prompt, then uses the stolen model to scan, exploit, steal credentials, and install miners—up to 100,000 unattended steps. The hijacked model’s owner pays the compute bill. Operators called the final loop “Skynet mode.
What Happened
Symantec/Broadcom threat report, The Decoder. Captured via honeypot; published Oct 21–22.
2026-10-22
Google DeepMind Researchers Are Quitting Over Pentagon AI Contracts
Two DeepMind researchers just quit because Google’s AI is going into classified military work. They didn’t wait for the sci-fi ending.
At least two Google DeepMind researchers (research engineer Sofia Liguori this week, AI researcher Andreas Kirsch earlier this month) have resigned over Google’s classified Pentagon AI contracts and related military work. Liguori said she felt ashamed; Kirsch questioned whether Google has meaningful oversight of how its models are used in classified settings. Other staff described similar concerns to the BBC.
What Happened
BBC, The Intercept, researcher statements. Sofia Liguori resigned this week; Andreas Kirsch earlier in October.
2026-10-22
The AI Boom Is Making Gray Paint a Growth Industry
Data centers are being painted gray on top of gray on top of gray, and paint companies have never had it so good.
Hyperscalers are coating data-center steel and concrete with specialized gray fire-resistant, anti-static, anti-corrosion paints. PPG says data-center paint sales are on track to triple this year; the company even has a product (Steelguard 951) whose sales are now a noticeable line. Gravel and wiring firms are also seeing an unexpected tailwind.
What Happened
New York Times, PPG earnings commentary. Oct 22.
2026-10-22
A 360-Million-Parameter Model That Pretends to Be a Terminal (No Shell Required)
Someone trained a small model to *be* a terminal. There is no computer behind it. It still lets you play snake.
A developer fine-tuned a 360M model (from Qwen2.5-Coder) so that every keystroke is fed to the network and the network predicts the next terminal screen. There is no real shell or filesystem. It can run vim, tmux, create files, play snake, and even try to repair its own mistakes. A 208 MB browser demo lets you type pythoon and watch it fail like a real (but imaginary) terminal.
What Happened
Creator’s blog and live WebGPU demo, Hacker News. Posted Oct 21.