What mattered · week 44
A flaw in PHP, the language under most of the web, sent governments offline; PHP, GitLab, Railway and a certificate authority had critical security failures in four days; Anthropic filed to go public, with backers reportedly targeting $2 trillion or more; and AI agents wrote a physics paper from question to draft.
This week brought more evidence for what I think of as AI's security apocalypse: bugs found faster than anyone can fix them. Also, Anthropic filed to go public.
What mattered
A flaw in PHP, the language under most of the web, sent governments offline. PHP runs about 70% of websites, WordPress included. This was the worst kind of bug: anyone could take over a server without logging in.
Japan's prime minister told organisations to patch that night or consider taking their sites offline. Dutch and Finnish government sites went dark, and the FBI and NSA issued warnings.
PHP was one of four critical failures in four days, alongside GitLab, the Railway cloud host and a certificate authority. AI is speeding up both finding and exploiting bugs, and the PHP Foundation says AI-assisted reports are flooding it. Anthropic's deputy CISO, Jason Clinton, says things will get "a lot worse before they get better", for about 18 months.
| What broke, 20–23 Oct | Severity |
|---|---|
| PHP: code execution without login, under WordPress | CVSS 9.2 |
| GitLab: code execution on every version since 2014 | CVSS 10.0 |
| Railway: customer secrets decrypted by an attacker after AI keys | Breach |
| eMudhra: eight certificate-authority keys recoverable | Revoked |
Sources: PHP Foundation, GitLab via The Hacker News, Railway, eMudhra via BleepingComputer.
Read more. On defence, Claude proved over 100 libraries crash-free, in a modelled setup. OpenAI set its own agents to attack its training sandboxes, and they escaped; two passed messages by timing the CPU cache. All of it: the AI cyber crunch.
Anthropic has filed to go public; backers reportedly want $2 trillion or more. About double May's $965bn private round. The filing shows $16.3bn of revenue in the first half of 2026, up 1,300% on a year earlier. Read more
OpenAI says its models settled three major open problems. The Exponential Time Hypothesis, assumed in hundreds of computer science papers, is false; Kakeya holds in every dimension; and Yang–Mills theory exists, half of a Millennium Prize problem. All are checked in Lean, with experts including Nobel laureate David Gross explaining them. Read more
AI agents picked a physics question, worked it through and wrote the paper. Two King's College London physicists asked ChatGPT and Claude to pick a question worth a Physical Review Letters paper. The agents chose the idea and drafted it in a couple of hours; checking took two weeks. Read more
One thing to try
Start each AI session fresh, and file as you go. A session is a desk, not a filing cabinet: long chats get slow and muddled. Keep what matters in files, and let each fresh session read them.
First step: at the end of today's chat, say "Write down what we worked out and where to start next time, as a short note I can save." Tomorrow, give that note to a new chat. Two minutes. Read the note
The bigger picture
At Anthropic, agents now work six hours for every human hour. In February it was about one agent hour for every ten human hours. Anthropic calls itself a leading indicator, and juniors fell from 27% to 9% of its technical hires. Read more
The effect is starting to show beyond tech: a Goldman Sachs note finds US industries using more AI have slower job growth and higher unemployment, a correlation, not proof of cause. Read more
From the log
- Block's Dessa: a voice model trained only on human speech, very realistic, that runs on a high-end MacBook Pro; waitlist only.
What did I miss? Just reply to this email. The rest of what I log is at wayintoai.com/logs.