Alex Stamos told the Big Technology Podcast (uploaded 23 October) that attackers use AI in some attacks and that the bug was found through an OpenAI-run project; he named no model.
Key points
PHP's 21 October advisory says PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix two critical flaws that can allow unauthenticated remote code execution, and urges all PHP users to update immediately.
Stamos said "we now have evidence that bad guys started exploiting this well before the public release" and gave no source for that evidence (02:25).
Stamos described "dozens or hundreds of hackers of hacking groups attacking tens of millions of websites" (06:35); it is his own estimate, with no measurement.
What it means for you · Our view
If your servers run PHP, update to 8.5.12, 8.4.27, 8.3.36 or 8.2.35 today: the PHP project says every installation serving web requests is at risk, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. Stamos's account of earlier exploitation and of attacks on tens of millions of sites is his own and unmeasured, so it is a reason for speed, not a count. He also says upgrading older PHP versions can break sites. If you cannot update straight away, ask your host or vendor today which fixed release it will run and when, and test the upgrade on a copy first. Read on →
Mistral's page lists transcription in 50 languages from $0.0035 a minute, a text-to-speech model and a LiveKit-based voice agent SDK; the benchmark comparisons are Mistral's own.
Abliteration edits an open-weight model so it stops refusing; Anthropic says doing it to GLM-5.3 cost roughly $4,400 and cut refusals from above 90% to about 3% and 2% on two benchmarks.
Abliteration edits an open-weight model so it stops refusing; Anthropic says doing it to GLM-5.3 cost roughly $4,400 and cut refusals from above 90% to about 3% and 2% on two benchmarks.
Checked 26 Oct · arXiv (Arditi et al.) · 3 sourcesNo reactions yet
Illustration: A desktop audio mixing unit with faders and a dial; its green clip-on module stands for the voice agent kit added to the speech models. · Illustration made with AI for ai notisClose
Illustration: A signal-filter unit with a row of slider channels; its one green channel stands for the single direction that refusal depends on. · Illustration made with AI for ai notisClose
Stamos says attackers exploited PHP flaws before the fix; PHP urges updating now
CognitionOpenAIPHP
Video: Alex Kantrowitz on YouTube
Alex Stamos told the Big Technology Podcast (uploaded 23 October) that attackers use AI in some attacks and that the bug was found through an OpenAI-run project; he named no model.
Stamos says attackers exploited PHP flaws before the fix; PHP urges updating now
PHP's 21 October advisory says PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix two critical flaws that can allow unauthenticated remote code execution, and urges all PHP users to update immediately.
Stamos said "we now have evidence that bad guys started exploiting this well before the public release" and gave no source for that evidence (02:25).
Stamos described "dozens or hundreds of hackers of hacking groups attacking tens of millions of websites" (06:35); it is his own estimate, with no measurement.
The Big Technology Podcast episode, uploaded to YouTube on 23 October 2026, is titled "The PHP Bug's Stunning Consequences + Cybersecurity's Black October — With Alex Stamos". The video's description names Stamos as the chief information security officer at Cognition. The PHP project's own advisory of 21 October 2026 says PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix two critical vulnerabilities that can allow unauthenticated remote code execution. Stamos said the bug is "a big deal because it is a pre-authentication remote code execution". He said "we now have evidence that bad guys started exploiting this well before the public release". He said the patch covers only the latest family of PHP, so sites on older versions face upgrades that can break them. He described "dozens or hundreds of hackers of hacking groups attacking tens of millions of websites". On AI, he said attackers are in some cases using it to run attacks, and that he has no good statistics on how widespread that is; he named no model. He also said the bug was found through a programme run by OpenAI, which the captions render as "Hack the Planet". Stamos said he runs an abliterated version of GLM-5.3 on a Mac Studio for exploit work, and described the open-weight models as a route by which these bugs would have been found anyway.
What it means for you Our view
If your servers run PHP, update to 8.5.12, 8.4.27, 8.3.36 or 8.2.35 today: the PHP project says every installation serving web requests is at risk, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. Stamos's account of earlier exploitation and of attacks on tens of millions of sites is his own and unmeasured, so it is a reason for speed, not a count. He also says upgrading older PHP versions can break sites. If you cannot update straight away, ask your host or vendor today which fixed release it will run and when, and test the upgrade on a copy first.
Mistral releases Voxtral 3 speech models and a voice agent SDK
LiveKitMistralVoxtral
Illustration made with AI for ai notis
Mistral's page lists transcription in 50 languages from $0.0035 a minute, a text-to-speech model and a LiveKit-based voice agent SDK; the benchmark comparisons are Mistral's own.
Mistral releases Voxtral 3 speech models and a voice agent SDK
Mistral lists Voxtral Mini Transcribe 3 (batch) at $0.0035 per minute, Voxtral Small Transcribe 3 at $0.0040 and the realtime model at $0.008 per minute.
Mistral says Voxtral Small Transcribe 3 outperforms Whisper, Scribe v2 and Gemini 3.5 Transcribe, with a diarization cpWER of 18.4%; these are its own evaluations.
The voice agent API costs $0.04 per minute with Mistral Small 4 and $0.08 with a larger model; Voxtral 3 runs on Mistral's EU-hosted API or on your own infrastructure.
Mistral AI, a French company, describes Voxtral 3 as speech models plus a voice agent SDK. It is available through Mistral's EU-hosted API or for self-deployment, and the page gives per-minute prices for each model. The comparisons with Whisper and other systems are Mistral's own evaluations. The page does not say whether the weights are public and gives no licence.
What it means for you Our view
This is a launch with prices, and the comparisons with other systems are Mistral's own evaluations. The per-minute prices let you cost a transcription or voice-agent workload before testing, and the EU-hosted API matters if your data must stay in Europe. Run your own recordings, with your languages and accents, through Voxtral Small Transcribe 3 and your current system, and compare the errors before you move any workload.
On the mornings we publish: the three top stories and up to four short ones. Free.
We email you a link to confirm. An issue may include one sponsor, always labelled Sponsored · Advertisement. Our emails count opens and clicks, not who made them. Unsubscribe in one click. What we keep
Get the app
Put ai notis on your home screen. No app store.
Put ai notis on this computer. No app store.
Tap Share (the square with an arrow), then Add to Home Screen .
If you can't see Share, tap (the three dots) first.
If you're a member, you'll sign in once more inside the app.
Stamos says attackers exploited PHP flaws before the fix; PHP urges updating now
Alex Stamos told the Big Technology Podcast (uploaded 23 October) that attackers use AI in some attacks and that the bug was found through an OpenAI-run project; he named no model.
PHP's 21 October advisory says PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix two critical flaws that can allow unauthenticated remote code execution, and urges all PHP users to update immediately.
Stamos said "we now have evidence that bad guys started exploiting this well before the public release" and gave no source for that evidence (02:25).
Stamos described "dozens or hundreds of hackers of hacking groups attacking tens of millions of websites" (06:35); it is his own estimate, with no measurement.
Mistral releases Voxtral 3 speech models and a voice agent SDK
Mistral's page lists transcription in 50 languages from $0.0035 a minute, a text-to-speech model and a LiveKit-based voice agent SDK; the benchmark comparisons are Mistral's own.
Mistral lists Voxtral Mini Transcribe 3 (batch) at $0.0035 per minute, Voxtral Small Transcribe 3 at $0.0040 and the realtime model at $0.008 per minute.
Mistral says Voxtral Small Transcribe 3 outperforms Whisper, Scribe v2 and Gemini 3.5 Transcribe, with a diarization cpWER of 18.4%; these are its own evaluations.
The voice agent API costs $0.04 per minute with Mistral Small 4 and $0.08 with a larger model; Voxtral 3 runs on Mistral's EU-hosted API or on your own infrastructure.
On the mornings we publish: the three top stories and up to four short ones. Free.
We email you a link to confirm. An issue may include one sponsor, always labelled Sponsored · Advertisement. Our emails count opens and clicks, not who made them. Unsubscribe in one click. What we keep
Get the app
Put ai notis on your home screen. No app store.
Put ai notis on this computer. No app store.
Tap Share (the square with an arrow), then Add to Home Screen .
If you can't see Share, tap (the three dots) first.
If you're a member, you'll sign in once more inside the app.
Alex Stamos told the Big Technology Podcast (uploaded 23 October) that attackers use AI in some attacks and that the bug was found through an OpenAI-run project; he named no model.
The Big Technology Podcast episode, uploaded to YouTube on 23 October 2026, is titled "The PHP Bug's Stunning Consequences + Cybersecurity's Black October — With Alex Stamos". The video's description names Stamos as the chief information security officer at Cognition. The PHP project's own advisory of 21 October 2026 says PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix two critical vulnerabilities that can allow unauthenticated remote code execution. Stamos said the bug is "a big deal because it is a pre-authentication remote code execution". He said "we now have evidence that bad guys started exploiting this well before the public release". He said the patch covers only the latest family of PHP, so sites on older versions face upgrades that can break them. He described "dozens or hundreds of hackers of hacking groups attacking tens of millions of websites". On AI, he said attackers are in some cases using it to run attacks, and that he has no good statistics on how widespread that is; he named no model. He also said the bug was found through a programme run by OpenAI, which the captions render as "Hack the Planet". Stamos said he runs an abliterated version of GLM-5.3 on a Mac Studio for exploit work, and described the open-weight models as a route by which these bugs would have been found anyway.
Stamos says attackers exploited PHP flaws before the fix; PHP urges updating now
Video: Alex Kantrowitz on YouTube
Alex Stamos told the Big Technology Podcast (uploaded 23 October) that attackers use AI in some attacks and that the bug was found through an OpenAI-run project; he named no model.
CognitionOpenAIPHP
Big Technology Podcast (Alex Kantrowitz) · 2 sourcesnow showing
Mistral's page lists transcription in 50 languages from $0.0035 a minute, a text-to-speech model and a LiveKit-based voice agent SDK; the benchmark comparisons are Mistral's own.
Mistral AI, a French company, describes Voxtral 3 as speech models plus a voice agent SDK. It is available through Mistral's EU-hosted API or for self-deployment, and the page gives per-minute prices for each model. The comparisons with Whisper and other systems are Mistral's own evaluations. The page does not say whether the weights are public and gives no licence.
Mistral releases Voxtral 3 speech models and a voice agent SDK
Illustration made with AI for ai notis
Mistral's page lists transcription in 50 languages from $0.0035 a minute, a text-to-speech model and a LiveKit-based voice agent SDK; the benchmark comparisons are Mistral's own.
Alex Stamos told the Big Technology Podcast (uploaded 23 October) that attackers use AI in some attacks and that the bug was found through an OpenAI-run project; he named no model.
Mistral's page lists transcription in 50 languages from $0.0035 a minute, a text-to-speech model and a LiveKit-based voice agent SDK; the benchmark comparisons are Mistral's own.
Alex Stamos told the Big Technology Podcast (uploaded 23 October) that attackers use AI in some attacks and that the bug was found through an OpenAI-run project; he named no model.
Mistral's page lists transcription in 50 languages from $0.0035 a minute, a text-to-speech model and a LiveKit-based voice agent SDK; the benchmark comparisons are Mistral's own.
Drag a card to startDrag left or right · tap to read moreHover to lift a card · tap to bring it forwardTap again to put it backTap a card to open itTap again to close itTap a headline to read it as a card
Keep this storyFollow this case
Join to keep it on every device. Free, with just your email.
