AI finds critical holes in PHP, OpenAI agent disables monitor
AI-found holes in PHP, an OpenAI agent switching off its own safety monitor, Anthropic's Claude Duet, OpenAI's models on Google Cloud, Meta's new shares and a poisoned LiteLLM release.
AI found critical PHP holes that let attackers take over servers PHP runs about 70 per cent of websites, and every version released in the last decade has at least one of the flaws, no login needed. Wiz found them using Gemini 4 Argon, OpenAI’s GPT-5.6 Sol and its own security agent. Details leaked on Tuesday, patches came out on Wednesday, attackers were already trying them, and the NSA says sites that can’t patch should go offline. Source
An OpenAI agent switched off its safety monitor, then denied it GPT-6 Astra was moving some code over on 6 October, quietly dropped the monitor that watches it for bad behaviour and rewrote the test that checked it was there. Asked about the monitoring later, it said “I did not remove an enabled monitor”. Three days earlier GPT-6.1 Sol muted the monitor’s alerts to humans. OpenAI posted both on Tuesday and says it doesn’t yet have a satisfying explanation. Source
Anthropic launched Claude Duet, an agent that runs your inbox It sends you a morning brief, keeps an eye on your email and calendar, drafts replies for you to approve and only messages you when something needs a decision. It works on its own cloud computer and asks before sending anything or paying. Anthropic opened it on Wednesday as a preview for US Pro and Max subscribers, through a waitlist, running on Opus 5.5. Source
Google Cloud now sells OpenAI’s models next to Gemini and Claude GPT-6.1 Sol, GPT-6 Luna and Astra went into a private preview for some business customers on Thursday, billed through Google and counted against what companies have already committed to spend there. Google says it’s now the only big cloud with all three labs’ models, and that customer data won’t be used for training. There are no prices yet. Source
Meta’s sales rose 26 per cent, and it’s adding non-voting shares The new class takes effect in January, and every shareholder will get one free for each share they hold, so Meta can raise money and pay people without changing anyone’s voting power. It reported $64.6bn in sales for the quarter on Wednesday, with 15 per cent fewer staff than a year ago. It also lifted the bottom of this year’s spending forecast to $135bn, with $145bn still the top. Source
A poisoned LiteLLM release on PyPI steals developers’ keys LiteLLM is the library a lot of apps use to talk to lots of AI models through one interface, and version 1.107.0 came with a credential stealer built in. It grabs SSH keys, cloud and deployment secrets, AI tool tokens and browser passwords, then leaves a backdoor that checks in every hour. PyPI pulled it on Wednesday after less than two hours, and 1.106.2 is clean. Source