DEDUPED
Top story
AI helped researchers find two critical flaws in PHP, the code behind roughly 70% of websites.
The flaws, called PHP2Shell, both score 9.2 out of 10 on the CVSS v4.0 severity scale, and PHP shipped patches on Wednesday, the day the details went public. Security firm Wiz says attackers can run code on WordPress, Drupal and Joomla sites without logging in, and that at least one flaw affects every PHP release from the past decade. Calif found one using OpenAI's GPT-5.6 Sol, and Wiz says it independently found both with Google's Gemini 4 Argon and GPT-5.6 Sol. Wiz says one researcher did in about a week what once took a team months. The details leaked about nine hours early, Cloudflare says it saw attack traffic before the announcement, and some European government and hospital sites went offline as a precaution.
Our take
The bugs sat hidden for a decade, and a researcher with a frontier model found them in days. Attackers can rent the same tools, so patch windows measured in weeks now look too slow.
The rest, ranked
-
1. DeepSeek reportedly raised about $15 billion.
The round is about 100 billion yuan, one of the largest ever in China, and reports name Tencent and CATL among the backers. It signals DeepSeek wants to compete head on with Anthropic and OpenAI.
-
2. OpenAI's frontier models and Codex workflows are coming to Google Cloud.
OpenAI says they will be available in Google Cloud's Model Garden and sold through Google Cloud Marketplace. What we read gave no launch date or pricing.
-
3. Walmart will let AI agents shop its site next month.
Shoppers can approve purchases and set spending limits, and Walmart's terms say agents must not act beyond what the shopper intends or change the payment method. Amazon, by contrast, has blocked Perplexity's and Meta's shopping agents.
-
4. Recursive released Flint, a free coding model that runs on a laptop.
It is Apache 2.0, a 40B mixture-of-experts model with about 2.5B parameters active, and the company says its automated research system built most of it. Recursive reports 74.2% on SWE-bench Verified. Ollama supports it on Mac for now.
-
5. Meta will create a new class of non-voting stock to fund AI.
Class C shares are meant for AI spending, acquisitions and employee pay, with trading to begin in 2027. Meta also raised its capital spending plans after $64.6 billion in third-quarter revenue, up 26%.
-
6. Tesla started Optimus production in California as profit fell 43%.
Musk says reaching 20,000 units a week will take more than a year. Revenue was flat while spending climbed on robots, AI and autonomy.
-
7. Barclays is cutting 5,000 jobs and says AI is starting to create efficiency.
The bank describes the cuts as part of a push to reduce costs.
-
8. Unitree showed H2-X, a humanoid "guardian" robot.
A promo clip shows it facing a knife-wielding intruder and lifting a car. Battery life is rated at 8 hours. The scenes come from the company's own video, not independent tests.
-
Quiet signal
9. big US banks are blocking AI agents from customer accounts.
Sources say Morgan Stanley has begun blocking third-party agents, and JPMorgan, Bank of America and Citi are restricting them. Banks struggle to tell agent activity from user activity, and most are moving toward read-only access. Morgan Stanley says it has not seen rogue agents on its platforms.
By category
Top stories in each category today, ranked.
- PHP2Shell. Two critical PHP flaws found with AI.
- Banks block AI agents. Quiet signal: read-only access spreads.
- DeepSeek raise. About $15B reported.
- OpenAI on Google Cloud. Models and Codex in Model Garden.
- Meta Class C stock. Non-voting shares to fund AI.
- Walmart agent gateway. Agents can shop with limits.
- Recursive Flint. Open laptop coding model.
- Tesla Optimus. Production starts in California.
- Unitree H2-X. Guardian humanoid robot.
- Barclays. 5,000 jobs cut as AI adds efficiency.
