Issue 10: An AI program found the PHP holes
AI-found holes in core PHP lead the week. OpenAI’s Patch the Planet program was one of two parties to discover PHP2Shell, which AINews says affects 70% of the web; patches shipped on 21-10-2026 after a two-month coordinated response, and AINews expects at least a year of such AI-found critical vulnerabilities. DeepSeek open-sourced its inference stack; from its disclosures, AINews’s own arithmetic comes to about $22m a day in revenue at an inference margin over 80%, though AINews calls what DeepSeek shared a strong revenue disclosure, not a complete margin statement. Anthropic gave Agent Skills to the Linux Foundation’s Agentic AI Foundation after nearly 280 million installs, and Codex and ChatGPT Work now keep a 12-hour prompt cache by default.
- Patch the Planet co-discovered PHP2ShellOpenAI's Patch the Planet, using GPT-5.6 Sol, and Wiz separately found two memory-corruption bugs in PHP's out-of-memory and fatal-error handling, with unauthenticated exploits shown against major CMSs. Cloudflare had mitigations in place and saw early attacks before the 21-10-2026 patches.
- DeepSeek DeepInfer: open-source SOTA inferenceDeepSeek open-sourced DeepInfer, V4.1 Flash's vLLM-based engine, without its KV cache, prefill/decode split or load balancing; prompt caching lasts up to 72 hours. DeepSeek says each cluster serves 155T tokens daily, cache hits included; AINews estimates about $22m daily and an inference margin over 80%.
- DeepSeek V4.1 Flash 1017, MiniMax M3.1 Flash, Mercury 3AINews says the three won't be in super wide use yet; per Artificial Analysis, V4.1 Flash 1017 scores 45 on its Intelligence Index, tying GLM-5.3 for second among open-weight models at $0.26 per task, though MiMo-V2.6-Pro and GPT-6.1 Sol (medium) score higher for less.
- sparqlite: SPARQL 1.1 inside SQLite, written in RustFrom one prompt, Claude Code for web in Ultracode mode, which writes JavaScript to coordinate subagents, worked over 12 hours to build it. The project's own summary claims 636 of 639 applicable W3C tests pass; Simon Willison says reviewing the code is not feasible.
- Battle Drones: a vibe coded RTSCoding agents, mainly Claude Code, built this browser RTS in 321 commits of TypeScript Simon Willison barely reviewed; it got fun when he asked Opus 5.5 in Ultracode mode to make it a lot more fun. Two devices in microphone range sync over audio.
- Pooling OpenAI subscriptionsFacing OpenAI capacity errors when Europe wakes up, Geoffrey Huntley pools six ChatGPT 500 accounts through Underclass, a proxy that pins each session to one account to keep its prompt cache warm. His experimental geoclass router retries capacity errors in another region over Tailscale.
- Donating Agent Skills to the Agentic AI FoundationAnthropic handed the standard's name, GitHub org and agentskills.io domain to the Linux Foundation body that holds MCP; more than 70 agent platforms, ChatGPT and Cursor among them, have integrated skills, with nearly 280 million installs. Proposed next: versioned releases and security guidance.
- Introducing Claude DuetA waitlist research preview for US Pro, Max and Ultra plans, sharing their usage limits: it checks connected accounts every few hours, messages only when something needs attention, and works on its own virtual machine, asking before it sends, pays, signs or deletes.
- 12-hour caching now on by default in Codex and ChatGPT WorkCodex and ChatGPT Work default to 12-hour caching as of 21-10-2026, the forum's running summary records; a day earlier it logged the API's 12-hour cache for shared instructions, tools and context, beside or mixed with the 30-minute default, at extra cost repeated reuse can outweigh.
- OpenAI models are coming to Google CloudOpenAI's announcement, quoted in the forum, says its frontier models and Codex agentic workflows will come to Google Cloud's Model Garden under Google's access controls and data governance, aimed at regulated industries, with Google Antigravity and the Gemini Agent due soon.