top story → PHP patches two critical remote code execution flaws after a disclosure leak, Moonshot ships Kimi K3.1 Pro and Anthropic donates Agent Skills

THE SUNDAY

What the people building AI said this week

Sunday 25 October 2026 · · covers Sun 18 Oct to Sat 24 Oct · ≈ 10 min

Lead story · Security

PHP patches two critical remote code execution flaws after the disclosure leaks

The PHP project released fixes on Wednesday for two remote code execution flaws that affect the whole 8.x line, moving the release up a day after CVE details began circulating on Tuesday. Willison says exploits were circulating by the night before the patch, after a security firm mistakenly published a working proof of concept video. Latent Space says OpenAI's Patch the Planet program was one of two parties to find the bugs, which it calls PHP2Shell. Zvi's AI #191 adds a GitLab flaw rated CVSS 10.0 and a Railway breach from the same days.

Simon Willison · Latent Space · Zvi · Tue 20 to Thu 22

##Models4 stories

Moonshot releases Kimi K3.1 Pro at $2 and $10 per million tokens, with open weights promised by 4 November

Moonshot made Kimi K3.1 Pro available through its API this week and says full weights will follow by 4 November. Willison lists $2 per million input tokens and $10 per million output, with a Highspeed version that runs 2 to 3 times faster at twice the price. Latent Space gives 2.8T total and 104B active parameters with a 1M token context. Artificial Analysis lists it at 55, behind Claude Opus 5.5 at 58.

Simon Willison · Latent Space · Artificial Analysis · Fri 23 to Sat 24

Intelligence Index, selected models

Effort setting as listed by Artificial Analysis. Bars scaled to 65. Kimi K3.1 Pro is a new row.

ModelWeightsIndex
Claude Opus 5.5 (max)closed58
Claude Sonnet 5.5 (max)closed56
Muse Wonder Full (max)closed56
Kimi K3.1 Propromised55
Claude Fable 5.1 (max)closed53
GPT-6 Astra (max)closed53
Gemini 4 Argon (high)closed53
Muse Wonder (max)closed52
Muse Spark Openopen39

closed weights  open or promised open weights  · Artificial Analysis leaderboard, checked Sun 25 Oct · Muse Spark Open's 39 is as Zvi reports it

Jack Clark tells the IMF the singularity has begun

His Import AI 477 is a transcript of a Bangkok speech that cites Humanity's Last Exam at 67.7% for Claude Opus 5.5, up from 8% in January 2025. He also says Anthropic's researchers produce almost 10 times as much code as in the company's first four years.

Jack Clark · Mon 19

Ankit Maloo on why models solve some hard math problems

He argues that models search many branches cheaply and use automated verifiers to prune dead ends, where humans go deep on a few ideas. Latent Space's essay cites a reported Navier-Stokes proof that took 10,000 agents, about 300B tokens and 88 hours.

Latent Space · Fri 23

Also The Interconnects roundup also lists Xiaomi's MiMo-V2.6-Pro-RL and NVIDIA's Nemotron-3.5-Super-VL-120B-A12B · IBM's Granite Speech 5.0 is on Hugging Face · Zvi's AI #191 lists Opus 5.5 fast mode at $8 and $40 per million tokens.

##Agents & tooling4 stories

Anthropic donates the Agent Skills standard to the Agentic AI Foundation

Anthropic is handing over the Agent Skills name, logo, GitHub organization and agentskills.io domain to the Agentic AI Foundation, which sits under the Linux Foundation and also hosts MCP. It says more than 70 agent platforms have integrated the standard, with 1 million skills published and nearly 280 million installed. David Soria Parra and Mahesh Murag are lead maintainers, and versioned releases, a proposal process and security guidance for skill authors are planned. Willison notes he predicted the move in December.

Anthropic · Simon Willison · Thu 22

Also Willison's Battle Drones is a browser RTS built through twelve major iterations with coding agents, with audio-based multiplayer · OpenAI's Decisions API is a low-cost API for fast, focused decisions · Hugging Face covers MPS in PyTorch 2.15 and AnyLanguageModel 1.0 for local models on Apple platforms.

##Security4 stories

Eight eMudhra intermediate CA keys are compromised, and uv, pip and certifi ship new certificate lists

Willison reports that the private keys of eight eMudhra intermediate CA certificates have been compromised. The intermediates chain to roots trusted by the Mozilla, Microsoft, Apple and Chrome root programs, so anything that bundles a trusted certificate list needs updating. Releases so far include uv 0.13.4, pip 26.2.2 and certifi 2026.10.19, and Linux distributions need to update their ca-certificates packages.

Simon Willison · Tue 20

Zvi warns of a wave of AI-driven attacks over the next 6 to 12 months

He cites a report of AI agents compromising more than 100 companies after about 1,200 attempts, at roughly $5,000 in tokens and about 23 hours per successful intrusion. He also notes that 46.1% of the top 7.2M PHP sites that show a version run an end-of-life branch.

Zvi · Fri 23

Also OpenAI describes stronger containment for frontier model training, and says Cloudflare uses its Daybreak to investigate vulnerabilities and propose fixes · OpenAI's Patch the Planet post frames the work as connecting researchers, maintainers and responders.

##Money & compute3 stories

DeepSeek open sources DeepInfer and reports about 155 trillion tokens a day from one cluster

Latent Space says the release covers the inference engine and API layer, built mainly on vLLM under Apache 2.0, and leaves out the KV-cache and load-balancing parts, so the production service cannot be fully rebuilt from it. DeepSeek's own unaudited figures include a 96% input-cache hit rate, which means much of those tokens are cached input, and $38 of revenue per accelerator hour at off-peak prices. The roughly 80% margin and 81 day payback are Latent Space's estimates. Interconnects calls DeepInfer one of the bigger open source AI artifacts of recent months.

Latent Space · Interconnects · Tue 20 to Wed 21

Also Zvi's AI #191 reports DeepSeek raised $15 billion and that Anthropic is in talks on a $45 billion cloud deal with Nscale · OpenAI is acquiring Orchestra Bio to bring AI operations to life sciences R&D.

##Opinion3 columns

Ethan Mollick · Tue 20

30 months on the exponential

Marking his new book Co-Existence, Mollick counts 180 models that now beat GPT-4 at its release, 19 of which run on a smartphone. He says the length of task AI completes at 50% reliability grew from about four minutes in 2024 to 17 hours by April 2026.

30 Months on the Exponential (in Charts)

Jeremy Scheff via Simon Willison · Mon 19

My obituary for programming

Scheff says programming paid well because programmers solved logic puzzles others could not, and coding agents take that role away. Willison adds that the loss is largest for developers who enjoyed solving the problems themselves.

My obituary for programming

Armin Ronacher via Simon Willison · Thu 22

The industry's old software debt comes due

Ronacher says the software industry built a lot of poor software over the past three decades. He suggests the trouble now arriving with AI is a consequence of that.

Quoting Armin Ronacher

##Audio

What will computer chips look like in 2045?

Dwarkesh Patel tours Intel's most advanced fab and talks with five Intel leaders, including CTO Pushkar Ranade. Ranade estimates Intel could roughly double its leading-edge wafer output with today's tools, while AI compute has grown about 3x a year.

Dwarkesh Patel · about 76 min, transcript included · Thu 22

##Back pagesworth re-reading

Why AI compute comes in rectangles: Erik Bernhardsson of Modal

He argues that fixed GPU contracts do not fit demand that grows, spikes and falls, so Modal pools demand across thousands of customers and rents from about 25 clouds. Latent Space notes that locking in capacity at today's prices risks losses if GPU prices fall.

latent.space · Thu 22

##And finally

A pelican on a bicycle turns up in a Dutch music video

Willison points out that one appears at 00:44 in De Staat's Freedom video, with visual effects credited to Fake it or Leave it.

DE STAAT - FREEDOM, Thu 22

##Wire

##Colophon

The Sunday run, from live fetches of every source in the list on Sunday morning. Feeds where they exist, the page itself for Anthropic and Artificial Analysis. Anything already linked in issue 8 was dropped. Summaries are original, everything links out, and no quotes this week. The window is Sun 18 Oct to Sat 24 Oct.

Three caveats. Thirteen items were filtered or skipped: nine OpenAI customer, partner, hiring or advertising posts (the NASK partnership, forward deployed engineering, Uber, AT&T, ChatGPT Ads in 26 countries, the ad stack, broad access standards, a franchisee and Terminal X), two Anthropic posts on a life sciences call for investigators and a Long-Term Benefit Trust appointment, Latent Space's quiet "not much happened today" digest, and Willison's llm-echo 0.5 release note. OpenAI's article pages returned an access error, so its items are listed from feed summaries. Hugging Face items are from titles only, and Zvi's PHP and security claims, and the figures Latent Space attributes to others, are theirs and unverified here.

Sources polled

18 checked · 3 quiet · 56 wire items. Counts include items relayed through a source.

SourceKindKept
Simon Willison's Weblogblog12
Latent Spacenewsletter10
Hugging Facelab blog12
OpenAI Newslab10
Don't Worry About the Vase (Zvi)newsletter2
Anthropic Newslab, page2
Interconnectsnewsletter1
Import AInewsletter1
One Useful Thingnewsletter1
Ahead of AInewsletter1
Hamel Husainblog1
Drew Breunigblog1
DeepMindlab1
Dwarkeshaudio1
Artificial Analysistracker, pageupdated
Armin Ronacher, SemiAnalysis, Eugene Yanvariousquiet

j k next / previous story   o open its first source   w wire   t theme

the sunday rebase · issue 9 · sun 25 oct 2026 · 0 7 * * 0 · next run sun 1 nov 2026, 07:00 cet