AI Uncovers a Decade-Old PHP Low-Level Vulnerability: A Full Retrospective of the PHP2Shell Incident
Two PHP remote code execution vulnerabilities with CVSS scores of 9.2 leaked before patches shipped, with OpenAI claiming GPT-5.6 Sol helped with the discovery; on the same day OpenAI released the Decisions API, Anthropic donated the Agent Skills standard to the Linux Foundation, and DeepSeek raised a new round of roughly $15 billion.
Model Releases & Updates
OpenAI Officially Releases the Decisions API for Low-Latency, Low-Cost Small Decisions
The Decisions API, built on GPT-6 Luna, is now generally available and purpose-built for bounded questions with clear answer boundaries, such as classification, routing, and scoring. According to the company, it can run up to 10 times faster than calling the same model through the Responses API.
Source: OpenAI official news feed (RSS · excludes enterprise/customer cases)
Product Releases & Updates
Claude Web, Desktop, and Mobile Will Enable auto mode by Default
Starting next week, sessions in the Claude web, desktop, and mobile apps for Pro, Max, and Team plans will run in auto mode by default, with a separate automatic check intercepting high-risk actions, and users can switch back to manual mode at any time. The Claude Code update notes that auto mode uses a separately trained classifier to review shell commands, blocking 89% of dangerous commands in testing, versus 14% for manual approval.
Source: X: Claude (@claudeai)
Replit Launches Monitoring Agent, an On-Call Agent That Can Autofix and Deploy
It can read production logs and metrics to investigate errors, slowdowns, and failed deployments, verify fixes and report by email once autofix is enabled, and automatically deploy those fixes once auto-publish is enabled. The capability builds on App Monitoring, which launched earlier.
Source: Replit Blog (RSS)
Industry News
AI Uncovers a Decade-Old PHP Low-Level Vulnerability: A Full Retrospective of the PHP2Shell Incident
Two PHP remote code execution vulnerabilities (CVE-2026-109618 and CVE-2026-109619) with CVSS scores of 9.2 leaked before the patches shipped, a video of the attack demo got out, and government websites in multiple countries were preemptively taken offline. OpenAI claimed credit for the discovery, assisted by GPT-5.6 Sol.
Source: X: 卡兹克 (@Khazix0918)
Bloomberg Reports DeepSeek Raising a New Round of Roughly $15 Billion
The fundraising target was raised at least twice during talks, from roughly $7.5 billion to $12 billion; CATL and Tencent are among the largest investors, with CATL reportedly putting in about $1.5 billion. The pre-money valuation is about $74.8 billion, and together with the first round of more than $7.5 billion closed in June, DeepSeek has raised roughly $22.5 billion in about six months.
Source: X: Rohan Paul (@rohanpaul_ai)
WSJ: Musk Wants a Merger of SpaceX and Tesla Built Around AI
SpaceX's AI business has become its largest business, with Q3 revenue of $7.56B (versus just $813M a year earlier), and more than $16.4B of $19.6B in quarterly capital spending went to AI, pushing SpaceX to a quarterly profit of $4.4B (versus a $1.05B loss in the same quarter a year earlier).
Source: X: Rohan Paul (@rohanpaul_ai)
Anthropic Donates the Agent Skills Open Standard to the Linux Foundation's Agentic AI Foundation
Anthropic announced it is donating the Agent Skills open standard to the Agentic AI Foundation under the Linux Foundation, having previously donated MCP to it.
Source: Anthropic Newsroom (web)
Inside Anthropic's Cap Table: VCs Arrived Late, and Now No One Holds More Than 2%
According to investor documents and multiple people familiar with the matter, venture capitalists stayed on the sidelines for years because of the company's governance structure and security-first approach, and no venture firm currently holds more than 2%, a level the company explicitly set as the cap for a single investor to avoid concentrating influence.
Source: Newcomer feature (RSS)
Wiz Discloses That the ARTEX Agent Was Used by Storm-0940 to Target IT and Software Vendors
In October 2026, attackers used the open source autonomous penetration testing framework ARTEX against multiple IT and software vendors, with the activity overlapping with the China state-affiliated group Storm-0940 reported by Microsoft, and it has already expanded into attempted supply chain attacks in other software verticals.
Source: Wiz Research (security research)
Research & Papers
Microsoft AI Releases the SDBench Benchmark and the MAI-DxO Diagnostic System, Published in Science
The Sequential Diagnosis Benchmark (SDBench) and the AI diagnostic system MAI-DxO were published in Science.
Source: Microsoft AI official blog (web)
METR and Redwood Research Red Teamed OpenAI's Internal Agent Monitoring System and Found Multiple Vulnerabilities
Each of the two organizations sent one employee to run a three-week high-privilege pilot stress test against OpenAI's internal miscalibration monitoring system from July 21 to August 11, producing a 61-page internal report.
Source: Redwood Research Blog (RSS)
Anthropic Used Claude to Complete Assembly-Level Formal Security Proofs for 123 Open Source Libraries
Anthropic worked with Theorem to turn OSS-Fuzz fuzzing into specifications, proving for 239 entry points across 123 open source libraries that arbitrary inputs below 64 MB do not crash, generating roughly 180 million lines of Rocq proofs.
Source: Anthropic Research (web)
Tips & Opinions
Anthropic Guide: When to Merge Subagents into the Main Agent Loop
An official practice guide discussing the circumstances under which subagents should be merged back into the main Agent loop instead of always staying independent.
Source: Claude Blog (web)
Symantec Reveals "Skynet Mode" AI Agent Hijacking of Unprotected LLMs to Launch Sustained Network Attacks
The attack path can sustain itself, with no need for a human in the loop to keep the rhythm going.
Source: The Decoder AI News (RSS)
Sierra Releases the τ-Entity Benchmark to Test Whether Voice Agents Can Accurately Capture Entities Like Names and Phone Numbers
An entity capture benchmark designed for voice scenarios.
Source: Sierra Blog (RSS)
MiniMax Code Desktop Adds Mini App Long-Running Application Feature
It moves coding Agents from one-off tasks toward persistent, always-on operation.
Source: MiniMax Blog (web)
Kling 4.0 Launches OpenArt and OnSolo
It supports first-frame, middle-frame, and last-frame guidance, plus up to 10 reference images.
Source: X: 可灵 Kling AI (@Kling_ai)
Quick Brief
- Reports say Anthropic may publicly file its S-1 as soon as this Friday, which could create the largest IPO in history (IT之家·人工智能)
【Hacker News Top Stories】
Keywords: AI OR GPT OR LLM OR Claude OR OpenAI OR "machine learning" OR "large language model" OR AGI OR "generative AI" OR AI agent OR RAG OR diffusion OR transformer
Source: hnrss.org | Curated from Hacker News
1. Scoop: Unvetted AI agents are accessing U.S. bank accounts
Article URL: https://www.axios.com/2026/10/22/ai-agents-banks-unauthorized-accounts-access Points: 1, Comments: 0
2. GM Aims to Bring 'Eyes-Off' Driving to AI-Powered Cars Within 2 Years
Article URL: https://www.nytimes.com/2026/10/21/business/gm-ai-electric-vehicles-china.html Points: 1, Comments: 1
3. From Eyeballs to ARR: Buzzy Pricing Metrics and the AI Trade
Article URL: https://aswathdamodaran.substack.com/p/from-eyeballs-to-arr-buzzy-pricing Points: 1, Comments: 0
4. AI compute is the new oil–and needs a new market
Article URL: https://www.economist.com/finance-and-economics/2026/10/22/ai-compute-is-the-new-oil-and-needs-a-new-market Points: 2, Comments: 0
5. The Next Bottleneck in AI for Science
Article URL: https://www.mixtureofexperts.co/p/the-next-bottleneck-in-ai-for-science Points: 1, Comments: 0
First published on WeChat official account "瑞哥观势".
About the Author
ERIC
AI Technology Expert, focusing on research and application of artificial intelligence and automation tools
Contact & Platforms