AI Found A Critical Web Flaw First. Can You Patch In Hours?

Today, we're diving into:

AI Found A Critical Web Flaw First. Can You Patch In Hours?

On Wednesday, the PHP project shipped emergency patches for two flaws that can let an attacker run code on a web server without logging in. Both are rated 9.2 out of 10 for severity.

The scale is what should get your attention. Wiz estimates PHP runs roughly 70% of all websites, and the first of these bugs was found with help from an OpenAI model.

AI Can Find Your Weak Spots In Days. Can You Find Your Systems?

See which of your systems are invisible to your team before someone else maps them for you.

The Defender's Window Opened. Then It Leaked.

Security firm Calif found the first bug in August using GPT-5.6 Sol, as part of a PHP code audit OpenAI funded. Wiz then found both flaws independently, using its own tooling alongside Gemini 4 Argon and GPT-5.6 Sol.

OpenAI calls this the "Defender's Window": AI finds internet-scale flaws before criminals do, and defenders get a head start. The company said it considers this "one of the most impactful security issues in recent memory."

Details leaked before the scheduled release. According to Recorded Future's timeline, Patchstack's hosting partners reported active exploitation hours before the fix shipped, and PHP pushed its release out early.

Who Was Told To Pull The Plug

Britain's NCSC and CERT-EU advised organizations to take systems offline if they could not patch immediately. Laravel paused its Cloud deployments while it rebuilt on patched images.

That is the new rhythm you should plan for. AI shortens the time it takes to find a flaw for everyone, including the people who want to use it.

The Real Bottleneck Is Not The Patch

The patch exists. The hard part is knowing every place it needs to go.

Among PHP services that reveal their version, Modat counted about 79% running branches the project no longer supports, per Recorded Future. One of the flaws can also leak memory, which may expose passwords, API keys and tokens.

Most enterprises do not lose these races because their security team is slow. They lose because nobody can say, within an hour, which marketing microsite, vendor portal or forgotten internal tool still runs an old stack.

What You Should Do This Week

The wrong reaction is to treat this as one bad week. The better alternative is to build an estate you can actually see, so the next AI-found flaw becomes a checklist instead of a scramble.

Building that visibility starts with trusted enterprise context. DataManagement.AI helps organizations create that foundation by unifying metadata, lineage, governance, business glossaries and knowledge assets into a single intelligence layer, so you know what you run, who owns it and what depends on it.

An AI Research System Just Built A Model That Runs On Your Laptop

Recursive, the AI lab co-founded by Richard Socher, released Flint on Wednesday, an open-weight coding model under the Apache 2.0 license. It is the company's first model.

The twist is how it was made. According to Startup Fortune, citing Socher's account to Wired, Recursive's automated research system, the "Eureka Machine," did most of the work while a small human team mostly watched and picked the best results.

When The Researcher Is Also The Machine

That matters for anyone tracking the road to AGI. Automating AI research itself is one of the steps most often named as a precursor to faster, compounding progress.

Be careful with the headline, though. Recursive has not shown that its system keeps getting better at discovering new methods, which is what recursive self-improvement actually means. Flint shows a process, not an improvement curve.

The Numbers Are Self-Reported

Recursive says Flint leads its size class on SWE-Bench Pro, SWE-Bench Verified and Terminal-Bench. No independent lab has verified those claims yet, and Wired's hands-on test covered only three small tasks.

This Fundamentally Changes The Cost Of Coding Agents

Flint is a 40-billion-parameter mixture-of-experts model that uses only about 2.5 billion parameters at a time. Socher says it runs at 125+ tokens per second on a MacBook Pro and 150+ on Nvidia's RTX Spark.

The wrong reaction is to let every developer download it and call it a strategy. Local models still write code that needs review, and the model card itself tells you to test generated code and enforce permissions in tool-using apps.

The better alternative is to decide which work belongs on a laptop, which belongs on a frontier API, and how you measure the difference. That is exactly the discipline behind Know Your Inference (KYI): matching each workload to the cheapest model that meets its quality bar, instead of defaulting to the biggest one.

OpenAI Just Moved Into Google's House

OpenAI announced on Wednesday that its frontier models and Codex are coming to Google Cloud's Model Garden. Customers buy through Google Cloud Marketplace and can draw down their existing Google Cloud spending commitments.

General availability is planned in the coming weeks. Microsoft, OpenAI says, remains its primary cloud partner.

Your Cloud Contract Just Became An AI Strategy

According to The Next Web, GPT-6 Astra, GPT-6.1 Sol and GPT-6 Luna are rolling out in private preview to select enterprises first. The deal puts OpenAI's models on all three of the biggest US cloud providers.

For you, the practical change is procurement. If you have committed spend with Google, OpenAI models can now come out of that budget, on one invoice, under Google's access controls.

Model Choice Is No Longer The Hard Part

Google says customer prompts and outputs stay inside the customer's data perimeter and are never used to train models. That removes one of the biggest objections your security team raises.

It also removes your excuse. When every major model sits in every major cloud, the question shifts from "which vendor can we get?" to "can we govern all of them the same way?"

The Wrong Reaction, And The Better One

The wrong reaction is to let each team pick its favorite model in its favorite cloud. Within a year you have five billing lines, five logging formats and no single view of what data each model touched.

The better alternative is a model-agnostic architecture: one governed context layer, many interchangeable models on top. That is how you turn a crowded marketplace into leverage instead of sprawl.

Your opinion matters!

Hope you loved reading our piece of newsletter as much as we had fun writing it.

Share your experience and feedback with us below 'cause we take your critique very critically.

Thank you for reading

-Shen & Towards AGI team