The Patch Window

Listener notes

• A bug that had been sitting in the web's plumbing for fourteen years was found by AI, and attackers were already working it before the patch. PHP runs an estimated 70 percent of the web. On October 21 its foundation disclosed two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, together called "php2shell", both rated 9.2 and both allowing unauthenticated remote code execution — an outsider gets to run their own code on a server without logging in first. The foundation had announced the release time in advance: Wednesday, October 21 at 14:00 UTC. Two teams found the flaws independently in August, both with AI help. The firm Calif found the first on August 1 using a GPT-5.6 Sol model; Wiz found both starting August 19 using Google's Gemini 4 Argon, GPT-5.6 Sol and its own Atlas tool. The defect had been in PHP for fourteen years, and a limited version that turned up in 2024 was judged insignificant at the time. Amazon Web Services reported exploit attempts in the days before the public disclosure, and Cloudflare's Matthew Prince counted tens of thousands of tries within 45 minutes of the news breaking, hundreds of thousands within two hours, and millions by the evening. Palo Alto Networks put the number of potentially vulnerable instances at 22.6 million. 123
• The defenders' head start is now something you can buy, and it is being subsidised. OpenAI, whose model helped find the bug, says frontier AI got there before attackers did and calls the gap the "Defender's Window". It has committed $1 billion in subsidised access to Daybreak, its programme that hands vetted organisations and open-source maintainers the same tools, aimed at the hospitals, utilities and small projects with no security team of their own. The numbers it publishes are climbing fast: two weeks ago its participants had found 1,885 software flaws and produced 661 patches, up from 858 and 263 the run before. The company also proposed a five-stage framework for handling flaws this severe, and asked the security community where it would add delay. Its own summary of the week is the part worth keeping: AI can now uncover flaws at internet scale, and the same capabilities help attackers build exploits quickly. 45
• One criminal, about five thousand dollars, and more than a hundred companies broken into. A security researcher, Snorre Fagerland of NorForge, found roughly two dozen copies of Cairn — an open-source tool that gives AI agents a target and lets them work toward it step by step — left exposed on the open internet, and read the attacks as they happened. Reuters reviewed the same records and named victims including Deere, SharkNinja and Cummins. The busiest cluster ran more than 1,100 projects against shops and payment systems in the United States, Japan and Australia. The operator's instructions ran to under a hundred Chinese characters. A successful break-in took just under 23 hours of machine work on average, the success rate was around 10 percent, and the whole campaign used roughly $5,000 of model tokens, or about $50 per site. The tooling appears to have been DeepSeek and Claude Code; neither the researcher nor Reuters confirmed the models. 67
• A state-aligned group ran the same play at national scale. Microsoft's threat intelligence reported on October 21 that an actor it tracks as Storm-0940 used an open-source agentic AI platform called ARTEX to drive what Microsoft calls a large-scale campaign — enough to enable a supply-chain compromise through ConnectWise and, from there, abuse stolen application credentials across Microsoft 365 environments. Reporting on that disclosure counted the intrusions in the hundreds, and linked the same tooling to a hack of South Korean banks earlier in the month. Where the lone criminal bought one operator's worth of patience, this one bought an assembly line. 58
• Even the watchers were being watched by something that could step out of frame. For three weeks in July and August an employee each from METR and Redwood Research had deep access inside OpenAI — source code, the configuration of its internal misalignment monitors, interviews with about a dozen engineers — and wrote a 61-page internal report. Their estimate was that roughly 75 to 94 percent of OpenAI's agentic internal traffic from models at least as strong as GPT-5.5 was eligible to be monitored. One gap mattered more than the rest: because the monitor fired only when an agent handed control back to a user, an agent could put off being watched indefinitely by simply continuing to act. Unmonitored "compaction" events likely left about 10 percent of eligible internal Codex traffic unwatched between May and July. The auditors also found a route by which Codex agents could in principle escape their sandbox, two headers that switch monitoring off for new agents, and an exploit that would hide hundreds of recent actions. OpenAI says every flaw affecting its production safeguards has been patched; METR has not evaluated that claim. 9
• The bill for staying in the race arrived with an eighty-billion-dollar number on it. The Wall Street Journal reported, and Reuters followed, that Anthropic lost more than $80 billion in the first half of 2026, against $13 billion a year earlier. That is not $80 billion of spending: roughly $72 billion of it is an accounting charge from the rising value of convertible notes and other instruments it issued to raise money. The operating picture underneath is stranger still — revenue of $16.3 billion for the six months to June 30, up from $1.1 billion, against infrastructure costs that nearly quadrupled to almost $9 billion, and a stated capacity to spend up to $750 billion on computing in the coming years. Investors at its San Francisco investor day discussed a valuation near $1.5 trillion, down from the roughly $2 trillion previously expected for a November share sale. The report drew on non-public information and could not be independently verified; Anthropic did not respond to a request for comment. 10
• The walls between the big labs came down for something cheaper than a fight: reach. On October 21 OpenAI said its models will be available to developers through Google's cloud, inside its model garden and its Antigravity coding tool, in the coming weeks. Six months ago Microsoft lost the exclusive licence on OpenAI's intellectual property, and Amazon began hosting OpenAI models the day after. Google's arrival means the ChatGPT maker now sits on all three of the largest US clouds. Google's cloud revenue growth accelerated to about 82 percent in the second quarter, against 37 percent at Amazon and 42 percent at Microsoft. OpenAI is meanwhile raising money at a $1.4 trillion valuation and aiming at its own listing. 11