Weekly News Roundup: CW43 - AI found the bugs first, and the exploits followed within hours

Two use-after-free bugs that had sat in PHP core since 5.4 became working exploits this week, because models could chain the steps that had made them impractical to exploit by hand, and within two hours of the patch Cloudflare was counting hundreds of thousands of attempts against its own network. The other side of the same capability arrived the same day: Microsoft described an actor running an open-source agentic pentest framework against hundreds of organizations and reaching privileged cloud access in under three hours, and CrowdStrike described four operators driving Claude Code through intrusions of their own. In answer, vendors shipped sandboxes and benchmarks in the same three days, and a frontier model arrived at half the incumbent’s price without its weights.

tl;dr

• 🐘 PHP2Shell, and the models that found it: two use-after-free bugs in PHP core from 5.4 onward, CVSS 9.2, found by Calif with GPT-5.6 Sol and independently by Wiz, patched on 21 October after two months of coordination, and followed by hundreds of thousands of exploitation attempts within two hours on Cloudflare’s own count, rising to millions by the time Prince posted.
• 🕵️ Storm-0940 used agents, and CrowdStrike found four more: Microsoft puts one actor at hundreds of organizations and 2,250 tenants with sub-three-hour privileged access, and CrowdStrike documents four operators running Claude Code harnesses of their own between May and August.
• 🛡️ Cisco pairs an agent sandbox with a benchmark: NVIDIA OpenShell supplies the sandbox and credential placeholders, DefenseClaw supplies policy and the audit trail, and Agentic FAITH adds VulnLoc, which scores finding the bug and not crying wolf, with no results published yet.
• 💸 Kimi K3.1 Pro, at $2 and $10, with the weights to come: Moonshot’s 3T-class model has a 1M context and lists at $2 and $10 per million tokens, half of Opus 5.5, the same as GPT-6.1 Sol and Sonnet 5.5, every benchmark Moonshot’s own, and the weights promised for 4 November.
• 🏗️ OpenAI points its models at COBOL and Fortran: in OpenAI’s own runs, MultiLangBench puts GPT-6 Astra at 87.4% across 20 languages against 26.8% for GPT-5.6 Sol, COBOL still the hardest at 72.1%, and the COBOL migration test at 97.9%, which OpenAI calls nearly saturated.
• 🎬 Imagination Studio puts a film studio on local hardware: an Apache-2.0 studio running Qwen-Image, FLUX3-K, MiniMax H3, Fish Audio and MiniMax Music on one Mac or DGX Spark, with the models keeping their own licences.

PHP2Shell, and the models that found it

Two use-after-free bugs in PHP core have been reachable by an unauthenticated attacker over the network since PHP 5.4. An attacker induces an out-of-memory condition with a crafted multipart request, PHP calls zend_bailout() and longjmps out mid-request, and the request’s $_POST and session state get cleaned up while something still holds a reference.

CVE-2026-109618 sits on the _zend_hash_str_add_or_update_i() path, where internal counters treat a string key as valid before it is initialised, so cleanup follows a function-pointer table through memory the attacker influenced; the same mechanism discloses heap contents through the PHPSESSID cookie value, which is where the ASLR bypass comes from. CVE-2026-109619 is global state that never resets: fatal_error_backtraces keeps a backtrace of the last fatal error, and a second request served by the same worker acts on the attacker’s remnant. Both are CVSS 9.2. OffSec’s breakdown puts the fixes in 8.2.35, 8.3.36, 8.4.27 and 8.5.12.

Two labs found them by different routes, and a sentence that credits one model gets the week wrong. OpenAI’s Patch the Planet post says Calif identified a critical flaw using GPT-5.6 Sol as part of the initiative, and that Wiz independently discovered and reported both vulnerabilities. Wiz’s own write-up names three systems, Wiz Atlas, Gemini 4 Argon and GPT-5.6 Sol, and credits Gemini 4 Argon for exploit development, attack detection and patch validation.

Wiz’s timeline has discovery on 19 August, unauthenticated remote code execution confirmed against Drupal on 20 August and WordPress on 21 August, the report to PHP on 24 August, an acknowledgement on 21 September and the patch on 21 October. OpenAI calls the result a Defender’s Window, its phrase for having found the bugs before attackers did, and that is the company’s assessment rather than a measurement. It also proposes a five-stage disclosure framework and commits $1 billion in subsidised Daybreak access for frontline defenders, both vendor commitments.

The measurement came from the network sitting in front of everybody’s PHP installs. Cloudflare had WAF rules live about nine hours before the public announcement, on by default for free and paid plans from 2026-10-21 03:02 UTC, and its post says the vulnerability was leaked before the official release date. PHP then shipped the fixes on 21 October, a day ahead of schedule, once technical detail began circulating.

Matthew Prince counted thousands of exploit attempts across Cloudflare’s network in the ten hours before disclosure, tens of thousands in the 45 minutes after, hundreds of thousands within two hours and millions by the time he posted. Those are first-party telemetry with no published dataset and no methodology, and they describe one company’s view of the internet. The protection itself is a capability Cloudflare calls full transaction detection, which reads the request and the response in the same HTTP transaction and can block the origin’s reply; PHP2Shell is its first managed detection. One caveat matters for anyone running PHP: sites that changed session.upload_progress.name from the default sit outside the rule.

The training industry moved at the same speed. TryHackMe had a room up within a day of the patch teaching the chain, the ASLR bypass and a shell, and it serves “This room is private” to anyone without a session, so nothing inside it can be cited. The 9.2 it quotes is right and it is not the room’s number: OffSec lists it for both CVEs and Wiz describes severity reaching 9.2.

The takeaway: the bugs are a decade old and the exploitation is not, and the only measurement of the wave that followed is one company’s own counters.

The same day brought the same shape in a different runtime. Node.js shipped security releases on 21 October: four high-severity CVEs across 26.x, 24.x and 22.x plus one medium, with updates to c-ares, ca-cert after an eMudhra intermediate CA compromise, OpenSSL, SQLite and Undici along for the ride. The one that matters most is CVE-2026-111497, an out-of-bounds write in the bundled Brotli decoder that can lead to remote code execution, reported by OpenAI Codex Security.

CVE-2026-105482 is the other interesting shape: dns.resolve silently truncates a hostname at a NUL byte, so attacker.example\0.trusted.example resolves attacker.example with no error, which breaks the validate-then-resolve pattern. Two TLS hostname bypasses complete the high set, CVE-2026-105483 with fullwidth digits in an IP literal as a regression after the CVE-2026-48618 fix and CVE-2026-106069 with a leading-zero IPv4 literal read as octal by the URL parser and decimal by the operating system resolver on some platforms. The advisory never mentions PHP. What it does show is a model vendor in the reporting chain, not only on the exploiting side of it.

Storm-0940 used agents, and CrowdStrike found four more

The intrusion side of that capability got its own documentation the same day. Microsoft’s threat intelligence post describes Storm-0940, a China-state aligned actor, using an open-source agentic penetration-testing framework called ARTEX to automate attacks against hundreds of organizations from as early as September 2026, across aerospace, automotive, chemicals, energy, financial services, government, legal, manufacturing, media, military, semiconductor, software, technology and think tanks. Microsoft reports that several attacks reached privileged access to cloud infrastructure in under three hours, assesses that the same actor was responsible for the ConnectWise supply-chain compromise of a multi-tenant application, and says it used ARTEX to attempt sign-in to more than 2,250 Microsoft 365 tenants with stolen application credentials, with no interactive sign-in.

ARTEX itself, as the post describes it, is a multi-agent LLM framework written in Go with a Next.js frontend, running a penetration test from reconnaissance through exfiltration with little human involvement and accumulating assets and findings into a graph, and its interface and output default to English before switching to Korean, Mandarin, Spanish or Japanese.

CrowdStrike’s report covers four previously unreported operators running their own agentic intrusions between May and August 2026, all of whom left their offensive frameworks exposed in open directories. The most detailed, in the report’s telling, is a Spanish and English speaking operator that compromised at least 15 Argentina-based healthcare entities and exfiltrated credentials and medical records from at least one, using a Supervisor Claude Code agent that picks tasks from a state machine and an Executor agent that carries them out, built on the open-source PentestGPT project with extra MCP servers and Python exploit scripts.

CrowdStrike puts a Chinese-speaking actor at more than 20 named global targets with two harnesses, and an Indonesian-speaking one at 819 skills, mostly public, with no orchestration and periodic human intervention to get past guardrails. All four framed the work as authorised testing to get past model safeguards, and CrowdStrike’s own summary, at moderate confidence, is that agentic AI “commoditizes baseline offensive cyber operations”.

The two reports do different jobs. Microsoft describes one actor at scale against cloud identity, CrowdStrike describes four operators whose agents made the decisions, and flattening them into one campaign would misrepresent both. The ConnectWise attribution is an assessment rather than a confirmation, and the hedge travels with it. Two of the numbers in circulation are second-hand: 151,000 failed sign-ins against 327 accounts at nearly 3,000 attempts per minute come from The Register’s and Tom’s Hardware’s readings of Microsoft’s post, and the ClawGod runtime patch plus the fourth actor’s language come from WIRED’s reading of CrowdStrike. What survives all of that is the technical claim CrowdStrike makes about scale, which Cybersecurity Dive quotes from the report: the barrier to running an intrusion campaign this way is “not engineering complexity but token budgets”.

Cisco pairs an agent sandbox with a benchmark

The countermeasures came from a vendor working from the same premise the intrusions used. A coding agent “acts with the full access rights of the developer who started it”, and can make file and network requests the visible tool calls do not show, and the DefenseClaw and OpenShell post splits Cisco’s answer in two. NVIDIA’s OpenShell is the boundary: every agent runs in a sandbox whose files, endpoints, tools, processes and credentials an administrator defines, with per-agent egress policy as the micro-segmentation layer, no direct network access for the workload, a trusted supervisor relaying every connection and denying what policy does not allow, and provider credentials issued only for authorised requests so the agent sees placeholders inside the sandbox.

Linux sandboxes are a container or a MicroVM, and on Apple silicon it is a MicroVM with its own kernel. It deploys to a workstation, cloud, hybrid, on-premises, edge and air-gapped setups.

DefenseClaw supplies the policy and the record. Rules and Cisco AI Defense inspect every prompt, tool call and result, web destinations are decided by host name without decrypting traffic, the developer can keep, undo or pull back whatever the agent changed at session end, and every block and approval is logged to Splunk or any OpenTelemetry backend. Agent traffic never flows through AI Defense, which acts as the policy endpoint instead.

The identity detail is the one to remember: the user’s directory group selects a policy profile, the profile shapes the sandbox and its egress policy, and where policy requires a sandbox DefenseClaw refuses an agent invoked directly on the host and prints the command to start it inside one. It also stops sandboxes started outside DefenseClaw. CW42’s Elsewhere carried Cisco’s DefenseClaw Edge Connector, which pushed allow and block decisions out to robots and IoT devices on 14 October; this is the workstation half a week later, with NVIDIA’s sandbox underneath.

Two days later Cisco extended its own evaluation framework to cover the kind of agent the sandbox protects. Agentic FAITH stretches Foundation AI’s FAITH so the same query, eval, summarize and run-all workflow covers multi-step, tool-using tasks rather than question answering alone, with the framework managing the model and tool loop and recording every exchange. The first integrated benchmark, VulnLoc, has two phases that measure different things. Phase A asks the agent to find the vulnerable files in a repository snapshot taken before the fix and scores it by file-set F1, so misses and wrong picks both cost. Phase B asks it to inspect the patched repository and report that the vulnerability is absent, scored by true-negative rate. Read-only repository access, Docker locally or Kubernetes through Agent Sandbox, explicit turn limits, tool-call budgets, timeouts and a recorded completion status are what make a correct “no vulnerability here” distinguishable from a crash.

No VulnLoc scores are published. This is infrastructure for benchmarks rather than a benchmark result, and both Cisco posts are vendor announcements with no independent testing of either.

Kimi K3.1 Pro, at $2 and $10, with the weights to come

The week’s other set of numbers was a price list. Moonshot’s launch post calls Kimi K3.1 Pro the first model in the K3.1 series and “our most capable 3T-class open-weight model to date”, with a 1M-token context, a post-trained version of Kimi K3 with substantially more post-training compute, and Kimi K3.1 Pro Highspeed alongside at two to three times the speed. It was available the same day on Kimi.ai, Kimi Work, Kimi Code and the Kimi API, with enterprise admins able to enable it and it off by default. The parameter split comes from Moonshot’s launch post rather than the tech blog: 2.8 trillion total, 104 billion active, mixture of experts, multimodal.

The prices are the part anyone can check. Moonshot’s pricing page lists kimi-k3.1-pro at $2.00 for input and $10.00 for output per million tokens, cached input at $0.20, cache writes at $2.00 for a five-minute TTL or $4.00 for an hour, and Highspeed at $4.00 and $20.00, flat across a 1,048,576-token context with no length tiers.

The post that carried the release says that is 50% below Opus 5.5 and 80% below GPT-6 Astra, and both numbers check out against the vendors’ own rate cards: Anthropic lists Opus 5.5 at $4 and $20, and OpenAI’s price list has GPT-6 Astra at $10 and $50. What the post leaves out is the tier this lands in, because GPT-6.1 Sol and Claude Sonnet 5.5 are both $2 and $10. That makes it the mid-tier price for an open-weight model, which is a real story and not the one “SOTA much cheaper” tells. The weights are promised by 4 November and are not out: no licence, no commercial terms, no memory requirement, and nothing has been run locally by anyone. CW42’s cheap tier was GLM-Legal at $0.15 a task and two free OpenCode slots, a sub-dollar story about how little a task could cost; this one asks what the middle of the market buys.

Every benchmark in the launch material is Moonshot’s own run. On Moonshot’s Terminal-Bench 4.0 run it comes in at 65.7% against Opus 5.5 at 66.4% and GPT-6 Astra at 58.2%, which is 0.7 points behind rather than parity. Moonshot’s BenchCAD figure is 92.7% with tools against 96.2 and 95.9, its OfficeQA Pro v2 number is 64.4, and on Kimi Code Bench 3.0 Long-horizon it reports 61.2% against K3’s 55.95%. The claim that it beats every listed US frontier model on 6 of 14 benchmarks is the poster’s count off a screenshot, and Moonshot’s own summary is the softer “matches or approaches the strongest proprietary models”.

Moonshot also documented what it chose to remove. It traced rising vulnerability-research performance to cyber content in the mid-training corpus and cyber tasks in the RL mix, took both out for the open-weight release while keeping general coding, and reported the before and after itself: 81.0% at pass@3 on an in-house xdev-bench-hard for the shipped checkpoint against 90.5% for the same pipeline without those measures. An internal hallucination bench fell from 23.4% to 8.3% on a stress test of Moonshot’s own design, which is not a general error rate.

The takeaway: the price is the number anyone can check, the benchmark table is Moonshot’s own, and the figure the lab published against itself is the cyber score it chose to remove.

OpenAI points its models at COBOL and Fortran

OpenAI published a benchmark table of its own this week, for a different kind of code. MultiLangBench asks a model to build a SQLite-compatible database engine from scratch in one of 20 languages, with database files as the shared interface and tests adapted from SQLite’s own suite. In OpenAI’s runs, GPT-6 Astra averages 87.4% test pass at maximum reasoning effort against 26.8% for GPT-5.6 Sol, and clears 83% in 19 of the 20 languages. OpenAI’s table has COBOL as the hardest of them at 72.1%, up from 10.9%, with OCaml going from 25.6% to 85.8%, Fortran from 21.4% to 83.5% and Visual Basic from 27.5% to 89.4%. OpenAI’s reason for picking these languages is in its own figures: COBOL supports more than 40% of online banking systems, 80% of in-person card transactions and 95% of ATM transactions, and Fortran runs in weather forecasting and nuclear reactor safety analysis.

The cheaper option is GPT-6 Luna, which OpenAI puts at 40.3% average for an estimated $0.77 per sample against $3.48 for GPT-5.6 Sol, about 78% cheaper, and that is the number that matters to anyone deciding what to run tomorrow.

The COBOL migration evaluation is the sharper test. A model has to migrate COBOL to C++, Java, Kotlin, Python or Rust with byte-for-byte parity on hidden tests, and a run counts only if every test passes. OpenAI reports GPT-6.1 Sol at 86.6% at low reasoning effort against 5.4% for GPT-5.6 Sol while costing 39% less, and at higher effort at 97.9%, which the report calls “nearly saturating the evaluation”. That is a warning rather than a win: the test is running out of room to separate models. The report’s own example of why parity is hard is COBOL’s fixed-point arithmetic, which discards excess decimal digits unless rounding is requested, so a rewrite that rounds instead runs cleanly and produces different financial results. All of these are OpenAI’s evaluations of OpenAI models on OpenAI’s benchmark, and no third party has run MultiLangBench. The mitigation is that OpenAI says it is releasing the benchmark and its test suite, which makes the claim checkable later rather than verified now.

Imagination Studio puts a film studio on local hardware

Not everything this week arrived as a benchmark or a price. Imagination Studio is a local, all-in-one creative studio for image, video with sound, voice, music and foley, built by Keys and Sam Wasserman and formerly posted as the keys plus Wasserman Slate AI Studio, and the bookmark that surfaced it names neither. It has six creative engines (Story, Image, Video, Previs, Sound, Edit) and Wasserman’s production tools built in, and it runs on its own TensorFold runtime, with int8 kernels on M5 tensor units and GB10 tensor cores and an installer that checks memory and disk before downloading anything.

Inside are Qwen-Image 2.1 Turbo and Full, FLUX3-K, MOSS-Image, MiniMax H3 and FastH3 for video with sound, Fish Audio Drama 3 for voices, MiniMax Music 3, MMAudio and Stable Audio Open for sound, and Nemotron 3.5 Bolt as the assistant’s brain, loaded and unloaded around renders. The hardware claim is the project’s own: one machine is the whole studio, an Apple-silicon Mac, an NVIDIA DGX Spark or an RTX Pro 6000, with nobody independent having benchmarked it.

The licence split is the whole story. Apache-2.0 covers the studio’s own code, with a NOTICE attribution requirement, and the models keep their own terms: Qwen-Image 2.1 is non-commercial under the Qwen Research License, MiniMax H3 carries territory limits, FLUX3-K sits under the FLUX Kommunity License, Fish Audio Drama 3 under a community licence, MMAudio weights are CC-BY-NC 4.0 and MOSS-Image is Apache 2.0. “Open source studio” is accurate about the studio and misleading about the output. CW42 covered a 27B model running on a jailbroken PlayStation 5 and llama.cpp recipes arriving as presets in Pi, which was local inference for text on hardware people already had. This is the generative media version of the same move, and the repository was created on 4 October with the redesign announced on 20 October, so the date here belongs to the announcement rather than the code. The person who posted it had been running MiniMax H3, Music, Drama 3 and Krea separately and values one control plane over all of them, which is a workflow observation from someone using the tool and not a benchmark.

Elsewhere this week

Off the main thread. Smaller discoveries worth telling, in the order I would tell them.

NIST, the NSA and CISA published key practices for incident readiness and response in super intelligence training and evaluation as a joint document numbered PP-26-4396: ten voluntary practices across five stages for labs training and evaluating highly capable SI agents, where SI means super intelligence and not control systems. The concrete asks are the useful part, from preserving model weights and intermediate checkpoints to keeping logs that reconstruct agent trajectories and reasoning traces, and cross-checking with models outside the family of the model involved when investigating. It is dated 16 October, four days before the NSA post that surfaced it this week.

Claude looks good on the iPhone Duo, as far as one poster and one build number can tell. Claude’s App Store build 1.261021.51 shipped on 23 October, the day the Duo went on sale, followed by 1.261023.20 the next day, with release notes reading “Squashed some bugs and improved the overall experience”. There is no Anthropic statement that Claude has a Duo layout, and Apple’s own post on Duo-optimised apps, updated 22 October, names Netflix, Prime Video, Paramount+, MLB, Word, Outlook, Zoom, Slack, Salesforce, Fantastical, Notewise, Things and Bear, not Claude. Build trackers list the update as rebuilt for Duo and unconfirmed, nobody has reported how it looks, and an app can ship after the Duo tooling opened and still be compiled against an older SDK, so a build date is not proof of a layout.

Harness2 is a Google Cloud AI Research paper on agents that rewrite their own scaffolding. The agent proposes edits to its own harness, meaning the system prompt, tools, memory and subagents, probes the candidates on the same task, and composes a better one from the behavioural differences between runs, which is why it needs no ground-truth verifier and can carry what it learned into the next task. The paper reports up to 11.5 points on WorkBuddy-Bench, 4.5 on JobBench and 11.8 percentage points on LAB partial pass for GLM-5 and Gemini 3.5 Flash, run through OpenCode and Codex, and the repository is Apache-2.0 at about 19,000 stars. The paper is dated 9 October and the posts about it are a week later, which is why it sits here.

OpenAI announced it will acquire Orchestra Bio, a platform that helps biopharma teams coordinate drug development across teams and partners, which will join Rosalind, the company’s life-sciences stack alongside GPT-Rosalind and Rosalind Workbench. No terms were disclosed and the post gives none, so there is no figure and no valuation. The interesting part is that the work being bought is coordination rather than science: OpenAI’s own example is a failed manufacturing batch delaying a trial, with agents tracing which activities and timelines are affected, which is worth paying for when development takes 10 to 15 years from target to approval.

ChatGPT Slides picked up a collaboration model on 19 October. You can share a deck with view, comment or edit roles, edit text, charts, images and shapes directly on the slide, and have ChatGPT apply feedback left in the comments, then present inside ChatGPT or export to PowerPoint or Google Slides. It is on Pro, Business and Enterprise. The feature page is undated, which is why the date is the post’s. Nothing published says which model builds the slides, how permissions are enforced or where the decks are stored.

Google AI Edge Foresight is an on-device macOS meeting companion, and the model underneath is the more interesting half. EmbeddingGemma 2 is 740M parameters on the Gemma 4 architecture under Apache 2.0, and it maps text, images, video frames and audio into a single vector space, so a text query can land on a moment inside an audio file without a transcript being made first. Google puts memory at about 191 MB of active RAM for the text-only weights and 567 MB for the full multimodal model on a Pixel 11 Pro. The app listens to system audio, expands shorthand bullets into notes from the live transcript and answers questions across local files, entirely offline and on Apple silicon only. It launched on 6 October, and the Gemma post this week was a re-promotion rather than the release.

The Codex community showcase has 39 projects, sortable by most upvoted or newest. The top entry, in its builder’s description, is a Kindle AI Usage Display, which uses Codex to jailbreak a ten-year-old Kindle so its lock screen becomes an e-ink dashboard of AI spend across Codex, Claude Code, Cursor, Copilot and Gemini, waking every six hours to refresh and then sleeping because e-ink holds an image without power. Two more for range, again as their builders describe them: Multi screen infinite artwork, generative art flowing across a mesh of ESP-32 chips, and a Codex-Built Greenhouse Winder, where a farmer automated ventilation with an ESP32, 24V motors and temperature sensors. The post itself is a bare link, so the builds are the story, and the best of them is a display for measuring your own AI usage.

Odyssey put a fruit fly brain inside a world model on 17 October, in its own words placing the connectome inside Odyssey-3 so the fly navigates “totally imagined, simulated worlds all by itself”. What is missing is the story, because there is no paper, no code and no method: not which connectome, with the 166,700-neuron MaleCNS map published in September the obvious candidate and FlyWire the other, not how generated frames become sensory input, and not how neural output becomes flight. A site that grades public claims about simulated fly brains, Shaduf, rated it unverified on 18 October. A connectome is a wiring diagram rather than a brain, and structure alone does not reproduce the dynamics, so the neuron model and the input and output mappings are precisely what Odyssey has not published.

Closing

The same capability that found the bug ran the intrusion and shipped the defence this week, and the claims that held up were the ones with a version number, a patch date or a price list attached to them. The one number nobody outside Cloudflare can check is how many PHP installs were actually hit, because the only count of the wave came from the network that watched it go past.

That’s the week. See you in CW44.