---
title: "PHP2Shell: AI finds decade-old PHP flaws, Railway breach, Claude Duet launches"
date: 2026-10-22
summary: "AI-found PHP flaws hit ~70% of the web, Railway freezes deploys after a secrets breach, and Anthropic launches Claude Duet, its proactive personal agent."
cover: "https://morningtokens.com/covers/2026-10-22.jpg"
url: "https://morningtokens.com/issues/2026-10-22/"
---

Pour a long cup today, because yesterday was mostly about security. AI models helped find two core PHP flaws that sat unnoticed for over a decade and touch roughly 70% of the web, and the NSA and CISA are telling anyone who can't patch to take their sites offline.

On the same day Railway paused every deploy after a breach of customer secrets that it links to attacks on AI inference providers. Outside security, Anthropic launched Claude Duet, its proactive personal agent, and Recursive released a laptop-sized coding model it says was mostly built by its own AI research system.

## Top news

### 1. Security · PHP2Shell: AI helps find decades-old PHP flaws affecting about 70% of the web

PHP shipped fixes on 21 October for two critical core-engine bugs, CVE-2026-109618 and CVE-2026-109619 (CVSS 9.2), that allow unauthenticated remote code execution and memory disclosure on almost every PHP version since 5.4. Wiz and Calif found them with frontier models, Calif as part of OpenAI's "Patch the Planet" program.

- **Where the bug lives:** in PHP itself, not in WordPress, Drupal or other apps. Wiz says even a "Hello World" app on an affected version can be vulnerable.
  - Fatal errors during a request, especially out-of-memory errors, can leave corrupted state behind, and a later request handled by the same worker reuses it.
- **The two CVEs:**
  - -109618: out-of-memory handling that leaves request data half-initialised.
  - -109619: request state that survives after its memory is freed (use-after-free).
- **What Wiz demonstrated:** a single `php2shell` exploit script achieved pre-authentication RCE on the latest WordPress, Drupal and Joomla container images.
  - Separately, it could read worker memory holding passwords, tokens and API keys from other requests.
- **Fixed versions:** 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP 8.1 and older are end-of-life and get no fix. Wiz says the patch fixes the root pattern, removing all known variants.
- **Models and coordination:**
  - Wiz used its Wiz Atlas agent with Gemini 4 Argon and GPT-5.6 Sol; Calif found one flaw with GPT-5.6 Sol.
  - Google says Gemini 4 Argon helped with discovery, exploit development, detection and patch validation.
  - Before disclosure, Automattic, Akamai, AWS, Cloudflare, Fastly, Imperva, Microsoft, Vercel, Google Cloud and others prepared WAF rules and guidance.
  - No exploitation in the wild had been seen when CISA published. CISA says to patch now or take PHP systems offline.

> Wiz: building a reliable exploit chain was "at the edge of what human researchers could practically achieve". LLMs remove that barrier by adapting exploits to different PHP versions, configurations and memory layouts.

**Why it matters:** Models found the bug, and the same models make it much cheaper to turn old, hard-to-exploit flaws into working attacks. Wiz compares it to Heartbleed and Log4Shell; expect more "ancient bug, now exploitable" disclosures.

Sources: [Wiz: PHP2Shell](https://www.wiz.io/blog/php2shell-php-rce) · [OpenAI: Patch the Planet](https://openai.com/index/coordinated-disclosure-of-critical-vulnerabilities/) · [CISA alert](https://www.cisa.gov/news-events/alerts/2026/10/21/critical-vulnerabilities-php-require-immediate-patching) · [Google Cloud guidance](https://cloud.google.com/blog/products/identity-security/responding-to-core-php-vulnerabilities-cve-2026-109618-cve-2026-109619) · [TechCrunch](https://techcrunch.com/2026/10/21/php-armageddon-openai-googles-wiz-find-ancient-holes-panicking-the-internet/)

### 2. Security · Railway breach exposes customer secrets, deploys frozen for hours

Railway found "anomalous activity" on 21 October in the systems that store customer environment variables, and an attacker may have obtained decrypted secrets for some users. It paused all builds and deploys, Enterprise included, and told every customer to rotate everything stored there.

- Railway says the breach is part of a series of attacks on platform companies aimed at compromising AI inference providers.
- It rotated the S3 credentials for every storage bucket and invalidated the GitHub tokens it held. Customers have to reconnect GitHub and redeploy to pick up the new bucket keys.
- It published guides for rotating Redis credentials and checking for unusual AWS access, and says it told upstream AI providers to revoke keys proactively.
- This continues a pattern from earlier this week: OpenCode's hosted Console was breached, and stolen provider keys were used to run up AI bills.

> @theo: his apps stayed down for 16 to 17 hours because deploys were frozen, and blocking deploys during a key roll is unacceptable.

**Why it matters:** API keys for model providers are now worth stealing at scale, so platforms that store them are being targeted. If your AI keys sit in a platform's environment variables, that platform is part of your attack surface.

Sources: [Railway disclosure](https://blog.railway.com/p/security-disclosure-wednesday-october-21st) · [Railway status](https://status.railway.com/incident/QH8L8B3E) · [Bucket and GitHub reset guide](https://blog.railway.com/p/security-disclosure-recommendation-redeploy-buckets-and-reconnect-github-after-the-credential-reset) · [@theo](https://x.com/theo/status/2113047601058873564)

### 3. Agents · Anthropic launches Claude Duet, a proactive agent that comes to you first

Anthropic launched Claude Duet, a standalone app (iOS, Android and claude.ai) in which Claude acts as an always-on agent, as a waitlisted research preview for US Pro and Max subscribers.

- **What it does:** sends a morning brief across your connected apps, checks them every few hours, messages you only when something needs you, and keeps working on tasks in its own cloud VM with a browser.
- **Built on Claude Opus 5.5:** it carries over your Claude memory, skills and connected apps, as one ongoing thread you can type or talk to.
- **Guardrails:** it asks before sending a message, making a payment, signing a document or deleting a file.
  - A new classifier and safety system prompt block it from sharing the most sensitive data, such as card numbers.
  - Like Claude Managed Agents, it never sees your passwords or sign-in tokens.
- **Limits:** it checks apps every few hours rather than continuously and uses the same plan limits as the rest of Claude.
- **Competition:** it goes up against Meta's Muse and OpenAI's Dots. @petergyang had early access and calls it the most proactive of the personal agents.

> Anthropic: Duet "might misread a thread or miscalibrate what's urgent", and it is weaker at personal errands like booking tickets.

**Why it matters:** All three big labs now sell a cloud agent that works without being asked, so competition is shifting from model quality to judgment: what to interrupt you about and when to ask.

Sources: [Introducing Claude Duet](https://claude.com/resources/articles/claude-duet) · [The Verge](https://www.theverge.com/ai-artificial-intelligence/1015843/anthropic-claude-duet-ai-agent) · [MacRumors](https://www.macrumors.com/2026/10/21/anthropic-claude-duet/) · [@petergyang review](https://x.com/petergyang/status/2112995494612082931)

### 4. Open models · Recursive Flint: a 40B coding MoE for laptops, built mostly by an AI research system

Recursive, Richard Socher's lab, released Flint, an Apache-2.0 coding MoE with 40B total and 2.5B active parameters that runs on a laptop. Recursive says its automated "Eureka Machine" helped build almost every part of it in under four months.

- **Speed:**
  - M4 Pro MacBook Pro: ~125–131 tokens/s.
  - RTX Spark: over 150 tokens/s.
- **Benchmarks (company-reported):** leads MoE models under 50B total parameters on SWE-Bench Pro v2, Terminal-Bench 2.1 and SWE-Bench Verified.
  - Rivals dense 25–40B models while running more than five times faster.
  - On Recursive's six-test average, only Qwen3.8 27B scored higher.
- **Context:** up to 512k; Recursive recommends staying within 256k.
- **What Eureka contributed:** a sparser expert layout, custom Metal and RTX kernels, and low-bit quantisation that shrank the model by 71% with little quality loss (including a 4-bit output layer, against common practice).
- **Running it:** Unsloth has dynamic GGUFs that run in about 24 GB of RAM. Wired's Will Knight tested it on a 48 GB Mac and says it handled his small app-building requests every time.
  - Recursive admits Flint needs more guidance than paid cloud assistants and recommends splitting big tasks into steps.
- Recursive was valued at $4.65B in May; this is its first model.

**Why it matters:** It's a real local option for private, offline coding agents with no per-token bill. It's also the first shipped model from a lab betting on recursive self-improvement, still supervised by people.

Sources: [Recursive: Introducing Flint](https://recursive.com/updates/introducing-recursive-flint) · [TechCrunch](https://techcrunch.com/2026/10/21/recursive-launches-flint-a-laptop-coding-model-it-says-was-largely-built-by-ai/) · [@UnslothAI](https://x.com/UnslothAI/status/2113046042908541083)

### 5. Infrastructure · DeepSeek open-sources DeepInfer, its production inference engine

DeepSeek released DeepInfer under Apache 2.0, the inference framework behind its own large-scale services. For now it ships offline inference for DeepSeek-V4.1-Flash on NVIDIA and Ascend.

- **Parallelism and scheduling:** attention data parallelism, balanced context parallelism, MoE expert parallelism with load balancing (EPLB) and an asynchronous zero-overhead batch scheduler.
- **"DSpark" speculative decoding:** uses confidence estimates to decide when to verify draft tokens (default draft length 5).
- **Also:** bounded-replay prefill for sliding-window attention, and structured output with regex, JSON schema or EBNF.
- **Batch-invariant mode:** identical outputs for identical inputs regardless of batch composition, useful for evals and reproducible RL.
- **Not included yet:** prefill/decode disaggregation and load balancing across replicas. Published benchmarks use 4 SM100 GPUs for prefill and 64 for decode.

**Why it matters:** Labs rarely open their serving engines. The scheduler, speculative-decoding verification and batch-invariance code show how DeepSeek keeps prices low, and features will probably show up in vLLM and SGLang.

Sources: [GitHub: deepseek-ai/DeepInfer](https://github.com/deepseek-ai/DeepInfer)

### 6. Business · Meta beats on revenue, creates non-voting Class C stock to help fund AI

Meta's Q3 revenue was $64.6B (+26%), but operating income fell 37% to $13.0B, mostly because of a $9.89B teen-safety settlement charge. It also created a non-voting Class C stock it can use to raise money for its AI push.

- **Q3 numbers:**
  - Capex: $34.9B.
  - Free cash flow: −$2.1B.
  - Excluding the legal charge: operating income $22.9B, EPS $7.40.
- **Guidance:**
  - Full-year 2026 capex: $135–145B (previously $130–145B).
  - Q4 revenue: $73–76B.
- **Class C:** every Class A and Class B share gets one Class C share, effective 19 January 2027. It works like a two-for-one split, and Zuckerberg keeps voting control.
- Headcount is down 15% year on year, to 66,775. Zuckerberg says Muse accounts have passed 10 million.

**Why it matters:** Negative free cash flow at Meta's size shows what frontier AI costs even for one of the most profitable ad businesses. A non-voting share class lets Meta issue equity for AI without diluting control.

Sources: [Meta Q3 2026 results](https://investor.atmeta.com/investor-news/press-release-details/2026/Meta-Reports-Third-Quarter-2026-Results/default.aspx) · [AP](https://apnews.com/article/meta-earnings-facebook-instagram-muse-capex-13ecd6c459e39a3602f302bcc2412fe9) · [CNBC live](https://www.cnbc.com/2026/10/21/meta-earnings-q3-2026-live-updates.html)

### 7. Cloud · OpenAI's frontier models and Codex come to Google Cloud

OpenAI and Google Cloud announced that GPT-6 Astra, GPT-6.1 Sol and GPT-6 Luna are coming to Vertex AI Model Garden, alongside Codex workflows. It starts as a private preview for selected enterprises, with general availability planned in the coming weeks.

- Customers buy through Google Cloud Marketplace, so the spend counts toward existing Google Cloud commitments.
- Codex CLI and Desktop can connect to Google's platform for inference.
- Google says it's now the only hyperscaler offering all three leading closed model families (Gemini, Claude and GPT) plus more than 200 other models.
- The models run on dedicated Google Cloud infrastructure, and prompts and outputs aren't used for training. Zero-data-retention and Confidential Compute options are "coming soon".

**Why it matters:** OpenAI's exclusive-cloud era is over. For companies whose data and budgets sit in GCP, the procurement obstacle to GPT-6 is gone, and multi-model routing within one bill gets easier.

Sources: [Google Cloud blog](https://cloud.google.com/blog/products/ai-machine-learning/google-cloud-brings-openai-models-to-customers) · [OpenAI preview form](https://openai.com/form/openai-on-google-cloud/) · [@OpenAI](https://x.com/OpenAI/status/2112988118471295323)

### 8. Science · Claude designs lab-tested binders against scorpion neurotoxins

An internal Anthropic research model, working in Claude Science mostly on its own for 64 hours, generated 318,484 protein designs against five scorpion neurotoxins. Of the 211 lab-tested designs, 17 met the binding criteria, each against one toxin.

- Claude picked 180 designs, and the team added 31 more with Claude's help. Adaptyv Bio and Twist Bioscience ran the binding tests.
- The project started with Citrini Research, which asked whether motivated non-experts could tackle a real health problem with Claude.
- None of the multi-toxin designs bound more than one toxin. A multi-toxin binder would be the cheapest route to a universal antivenom.
- Anthropic doesn't claim an antivenom: neutralisation hasn't been tested. Outside experts called it a promising first step and said binding is no longer the main bottleneck.
- Scorpion stings affect over 1.2 million people a year and cause over 3,250 deaths, mostly children. Anthropic is releasing all 211 designs and the data.

**Why it matters:** This is a real wet-lab result in a neglected disease, done in days of compute rather than months. Its honesty about limits makes it a useful benchmark for AI drug-discovery claims.

Sources: [Anthropic research post](https://www.anthropic.com/research/claude-scorpion-toxin-binder-design)

### 9. Commerce · Walmart opens an Agent Gateway while Amazon blocks shopping agents

Walmart launched an Agent Gateway for AI agents to shop on Walmart and Sam's Club, with Agent Profiles that have spending caps and published "terms" for agents. Amazon recently blocked agents from making purchases for shoppers.

- An Agent Profile is created the first time an agent shops through the gateway. You link it to your Walmart account, set controls and limits, and can delete it any time; Walmart+ isn't required.
- Under the terms, agents can't go beyond the shopper's intent, can't see payment details, and get only the data the task needs. Violators get blocked.
- Walmart's normal returns apply even when an agent doesn't act as intended.
- Walmart already works with Meta's Muse, ChatGPT and Gemini.

**Why it matters:** It's the first big retailer to publish both rules and a dedicated route for agent shoppers. If it works, scoped identity, spending caps and a liability promise become the template.

Sources: [TechCrunch](https://techcrunch.com/2026/10/21/while-amazon-blocks-ai-agents-walmart-rolls-out-the-welcome-mat/)

### 10. Compute · NVIDIA Confidential Bare Metal and Google Cloud's Vera Rubin A5X

NVIDIA added Confidential Bare Metal, which lets frontier labs run their own full software stack on third-party GPU servers while hardware isolation protects model weights and data. Separately, Google Cloud's Vera Rubin NVL72 A5X instances reach general availability next month.

- NVIDIA Confidential Computing now comes as bare metal, containers (Kubernetes) and VMs, covering Grace Blackwell and Rubin systems and integrating with the DSX OS reference architecture.
- Cohere is adding it to Model Vault, and Google Cloud is bringing it to A4X Max (GB300 NVL72) instances.
- **A5X:** Vera Rubin NVL72, ConnectX-9 SuperNICs, Google's Virgo network and fourth-generation liquid cooling.
  - Google plans to scale to as many as 960,000 Rubin GPUs across several sites and to expand to Europe.
- The first A5X customer is Ineffable, David Silver's London lab, building reinforcement-learning "superlearners".

**Why it matters:** Fear of weights leaking on someone else's hardware limits where labs deploy. Hardware-rooted isolation makes more neoclouds and sovereign providers usable, and this week's key thefts show why.

Sources: [NVIDIA: Confidential Bare Metal](https://blogs.nvidia.com/blog/confidential-computing-model-builders-infrastructure/) · [NVIDIA: Google Cloud Vera Rubin](https://blogs.nvidia.com/blog/google-cloud-vera-rubin-infrastructure/)

## GitHub repos

- **[stablyai/orca](https://github.com/stablyai/orca)** (★101,578, +8,705 this week) — a workspace for running a fleet of coding agents (Codex, Claude Code, OpenCode, Pi) side by side, each in its own git worktree.
  - Send one prompt to five agents and merge the best result, steer from your phone, run on a remote box, and see Claude and Codex rate limits in one place.
- **[ethanplusai/harvey](https://github.com/ethanplusai/harvey)** (★2,009, +1,491 this week) — an autonomous outbound-sales agent that runs locally on your existing Claude Code or ChatGPT/Codex subscription, with no API key.
  - Finds businesses via OpenStreetMap, reads their sites, writes tailored cold-email sequences and handles replies; emails wait in an outbox for approval.
- **[deepseek-ai/DeepInfer](https://github.com/deepseek-ai/DeepInfer)** (Apache 2.0) — DeepSeek's production inference engine (see item 5).

## Research papers

- **Matrix-Game 4.0** (2610.27999) — separates game logic in an executable engine from visuals from an autoregressive video renderer, for real-time playable worlds with consistent state. [HF](https://huggingface.co/papers/2610.27999)
- **Ropedia W0** (2610.26855) — a world foundation model for walking-plus-manipulation robots that combines human and robot data through a shared kinematic representation. [HF](https://huggingface.co/papers/2610.26855)
- **PAR: Progress-Aligned Recurrence** (2610.27628) — trains looped language models to match intermediate states, giving strong length generalisation on state-tracking tasks. [HF](https://huggingface.co/papers/2610.27628)
- **CoEvo-RSI** (2610.25078) — self-improving agents whose harness evolves faster than the model, with inheritance in both directions to keep them aligned. [HF](https://huggingface.co/papers/2610.25078)
- **Cache Engineering for Agents (AKV)** (2610.28577) — "drop" and "reposition" operations on an agent's KV cache that improve speed and accuracy on long runs without changing the trajectory. [HF](https://huggingface.co/papers/2610.28577)
- **S-Agent 2.0** (2610.28354) — gives a general coding agent persistent scene memory and 3D perception tools, improving spatial reasoning. [HF](https://huggingface.co/papers/2610.28354)

## AI agent use cases

- **Audit your PHP estate:** have an agent list every server, container image and shared host running PHP, flag anything below 8.2.35, and draft the upgrade and redeploy plan.
- **Rotate and cap your AI keys:** if you use Railway, rotate every variable, then check provider dashboards for unexpected usage and set spend limits on every AI API key.
- **Try Flint locally:** on a 32–48 GB Mac, run the Unsloth GGUF on small, well-scoped coding tasks and compare it against your cloud agent.

## AI workflows

**1. [HubSpot blog moved to WordPress by Claude Code in one unattended run](https://x.com/wilreynolds/status/2112323536131899520)**
- **Replaces:** a manual CMS migration (copying posts, images, forms and tracking from HubSpot to WordPress), the kind of job that keeps companies locked into a platform.
- **Results:** Claude Code ran on its own for about 6 hours and emailed when done.
  - The staging site was hard to tell apart from the original, and forms and tracking were moved over as embeds.
- **What to connect:**
  - Claude Code;
  - the HubSpot MCP and the WordPress MCP (a WordPress business plan was needed for the full MCP);
  - deep research up front on both platforms' docs.
- **Bonus:** after the move, the WordPress MCP also lets you edit posts by voice from a phone.
- **Who it's for:** marketing teams and small businesses stuck on a CMS they want to leave, and agencies that do site migrations.

**2. [Agency cuts ~$14K/month of retainers with Apify, Claude templates and a Slack check](https://x.com/samwoods/status/2112968415094640951)**
- **Replaces:** outside contractors for repeatable sales and ops work:
  - a $4,000/month SDR retainer (inbound triage and lead enrichment);
  - a $3,500/month proposal designer;
  - about 12 hours a week of status meetings.
- **What to connect:**
  - automated inbound triage with Apify for enrichment;
  - a structured Claude markdown template for proposals;
  - an automated daily Slack audit check instead of status meetings.
- **How it works:** the software stack stayed the same; each handoff got an explicit validation gate.
- **Who it's for:** small agencies and service businesses paying outside contractors for repeatable sales and ops work.

**3. [Weekly client report drafted by n8n and Claude instead of copy-paste](https://x.com/Jalaj___/status/2112538346086166777)**
- **Replaces:** about 6 hours a week of someone copying numbers from 4 dashboards into a client report.
- **What to connect:** an n8n workflow that pulls the same 4 sources, and Claude to draft the report; a human reviews and ships it.
- **Results:** built in 1 day, paid back in under 3 weeks.
- **Who it's for:** agencies and freelancers who send recurring client reports, and anyone who assembles numbers from several dashboards every week.

## Quick hits

- **GitLab CVSS 10 patch** — CVE-2026-110264, an unauthenticated RCE from an integer overflow in the regex compiler, affects every self-managed version back to 7.0. [GitLab](https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-5-1-released/)
  - Upgrade to 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10 or 18.11.13. GitLab.com is already patched.
- **Node.js security releases** — 26.12.1, 24.22.1 and 22.23.4 fix a Brotli decoder out-of-bounds write that allows RCE (CVE-2026-111497). [Node.js](https://nodejs.org/en/blog/vulnerability/october-2026-security-releases)
  - Also fixed: several TLS hostname bypasses, and `crypto.randomUUID()` values repeating across processes started from snapshots or single-executable apps.
- **First new Claude API version since 2023** — `2026-10-21` drops `temperature`, `top_p` and `top_k` (now a 400 error) and changes document blocks and citations. [Migration guide](https://platform.claude.com/docs/en/api/migration-2026-10-21)
  - New major SDKs ship with it (Python 2.0, TypeScript 1.0). Bedrock calls to Opus 4.6 and older should stay on the old version.
- **Flapping Airplanes raises $1B at $6B** — the year-old lab trains large models with less data; its valuation is four times January's. [TechCrunch](https://techcrunch.com/2026/10/21/year-old-ai-lab-flapping-airplanes-raises-1b-at-a-6b-valuation/)
  - It says its megakernel framework can train, serve inference and even play video games in a single GPU kernel.
  - Index and Lux led the Series A, with Sequoia, GV, Kleiner Perkins and NVIDIA among the investors.
- **Blacksmith hits $1B; Asymptote raises $5.5M** — money for keeping agent-written code and agents in check. [Blacksmith](https://techcrunch.com/2026/10/21/blacksmith-hits-unicorn-valuation-after-sequoia-leads-series-c/) · [Asymptote](https://www.asymptotelabs.ai/blog/asymptote-labs-raises-5-5m-seed-round)
  - Blacksmith (CI for agent-written code): Sequoia-led Series C, ARR up 17×, over 90 million CI jobs run.
  - Asymptote's Beacon: an MIT-licensed telemetry layer on OpenTelemetry for Claude Code, Codex, Cursor and 20+ other agent tools.

## Go deeper

- **[Wiz: PHP2Shell full write-up](https://www.wiz.io/blog/php2shell-php-rce)** — the use-after-free and memory-disclosure chain, plus detection signals for defenders.
- **[Recursive: Introducing Flint](https://recursive.com/updates/introducing-recursive-flint)** — what an automated research loop contributed to a shipped model, from architecture search to Metal megakernels.
- **[Anthropic: Claude-designed binders for scorpion neurotoxins](https://www.anthropic.com/research/claude-scorpion-toxin-binder-design)** — the full method, the failed multi-toxin attempts and the released dataset.

*Caveats: Flint's benchmarks and speeds and Blacksmith's growth figures are company-reported; Duet impressions come from one early-access user.*