Sunday 25 October

OpenAI announced it will no longer use live internet data when training its most advanced models, switching to a cached copy of the web. The change follows a recent security incident where a research model accessed the internet due to a configuration error, prompting a pause and a security overhaul. The company said the decision is based on the current state of alignment research and internet infrastructure security.

Why it matters: Developers must adapt to reduced real‑time data availability, affecting model capabilities and integration strategies.

TechCrunch + 2 moreSave

Two critical bugs were discovered in the PHP programming language, which powers the majority of internet sites, and they threatened to upend the internet. Experts say fixing the flaws is not as simple as clicking “Update” and advise assessing risk and taking protective steps.

Why it matters: PHP’s ubiquity means the vulnerabilities could impact a large portion of web applications and services.

TechCrunch + 1 moreSave

Moonshot AI released Kimi K3.1 Pro, a 3‑trillion‑parameter open‑weight model with a 1‑million‑token context window and a high‑speed variant that is 2‑3× faster. The model scores 55 on the Artificial Analysis Intelligence Index, an 11‑point gain that places it fourth behind three Anthropic and Meta models, and it nearly matches Claude Opus 5.5 on a coding test. Moonshot will publish the model’s weights by 4 November 2026 and has removed hacking‑related training data to limit misuse.

Why it matters: Developers can now run a top‑tier, open‑weight LLM locally and customize it, with full weights becoming available soon.

The Decoder + 4 moreSave

A UEFI bootkit called BlackX, observed in early 2026, leveraged the Baton Drop vulnerability to bypass Secure Boot and load a malicious driver that interferes with Kaspersky and Avast security solutions. The campaign targeted diplomatic organizations in Tajikistan, Uzbekistan and Turkmenistan and is attributed to the China-linked APT41 group.

Why it matters: It demonstrates that even patched Windows systems can be compromised via firmware attacks, highlighting the need for robust supply‑chain and firmware security measures.

BleepingComputer + 1 moreSave

Researchers remotely disabled the updater in the abandoned Time4Popcorn app, a Popcorn Time fork, closing a flaw that could have let attackers execute code with elevated privileges on millions of computers. Between November 2025 and March 2026 the Dutch firm Eye Security pushed more than 2 million updates to devices it did not own to switch off the background updater that could have been used to take over machines.

Why it matters: Unpatched updaters can become entry points for botnets, posing a large-scale security risk for any organization’s endpoints.

BleepingComputer + 1 moreSave

Researchers using AI identified significant security flaws in PHP, the scripting language that powers most websites. The language’s governing organization and the FBI’s cyber division issued a warning on Wednesday, prompting government agencies, corporations and other entities to assess exposure.

Why it matters: PHP vulnerabilities can affect any web‑based service, making immediate remediation critical for developers and security teams.

ET Tech + 1 moreSave

Microsoft Research released the Agensh harness as open source. The system operates without a central orchestrator, letting self‑organizing workers share a Git repository, chat, and a findings board. It can scale from a single agent to 1,024 agents on ProgramBench within a six‑hour budget.

Why it matters: It provides developers a ready‑to‑use framework for building large‑scale, decentralized multi‑agent applications.

MarkTechPostSave

Cognition released the Devin Vulnerability Fixes plugin, which includes three MIT‑licensed agent skills. The skills inventory, patch, and test PHP, Node.js, and self‑managed GitLab deployments affected by recent critical RCE flaws, and automatically open one pull request per repository. The plugin is offered as an open‑source agent plugin.

Why it matters: It lets security teams automate remediation of high‑severity vulnerabilities across common development stacks.

MarkTechPostSave

A Show HN post titled “Steal My Bitcoin” demonstrates a PHP remote code execution exploit the author built out of curiosity. The post has attracted 440 points and 264 comments on Hacker News.

Why it matters: It highlights ongoing PHP security vulnerabilities that developers need to address.

Hacker NewsSave