A PHP patch rush, without a global cyber meltdown
- AI-assisted research surfaced a PHP flaw that had persisted for years, and an early patch leak accelerated repairs.
- Podcasts disagreed on how far the danger reached: the patch rush was real, but hosts reported no broad outage.
- Old sites may remain exposed as AI makes vulnerability hunting faster for defenders and attackers alike.
OpenAI’s Glasswing project found a long-standing PHP vulnerability with help from AI, according to ARK Invest hosts Brett and Nick. They said the patch leaked before all users had installed it, prompting a rushed effort to secure widely used infrastructure.
That rush did not mean the internet had collapsed. Adam Curry, on We Get To Do This, called the “Black October” framing an overreaction: everyday services kept working, he said, and there was no global cyber meltdown.
The estimates of the flaw’s reach need context. Breaking Points relayed a claim that 70% of websites were affected. Nerd Snipe’s Theo and Ben said PHP still underpins 70% of the internet, but less than 10% of web traffic reaches the sites they discussed. They estimated those sites accounted for 1% to 3% of traffic, excluding bots and scrapers. A large software footprint, they suggested, does not mean most visitors reach vulnerable pages.
The concern is what happens beyond the busiest sites. John, on Bankless, said poorly maintained websites may remain vulnerable even after better-managed systems are patched. Nerd Snipe’s hosts also warned that neglected PHP code can sit inside critical services.
The shows see AI as both a security tool and a source of pressure. Brett and Nick said frontier models can help defenders find flaws before attackers do. On Hard Fork, Mike Isaac doubted defenders would keep pace, while Max Reed cited Joshua Sachs’s view that they still have time to strengthen systems before criminals adapt. The patch response showed how quickly a flaw can demand attention; the harder test is whether less-maintained systems get fixed before someone exploits them.
Source Intelligence
- Deep dive into what was said in the episodes
$VVV Community Call | October • Nov 1
- David cited a PHP vulnerability as a warning about internet-wide exposure, and John said poorly maintained sites may remain vulnerable even after better-maintained systems are patched. John argues crypto infrastructure has already faced intense honeypot risks and may be better prepared for this threat environment.
Also discussed on this episode: (15)
Adoption (1)
- John says Venice passed 5 million users in October, after taking 13 months to reach its first million and just 68 days to grow from 4 million to 5 million. Usage, signups, subscriptions, and revenue were all accelerating.
Models (5)
- Venice’s daily token volume rose from 250 billion at September’s end to over 1 trillion in October. John links the sharp inflection to replacing older defaults with an uncensored DeepSeek model, which increased usage, signups, subscriptions, and API-credit activity.
- John expects agentic chat to become the main chat experience, while preserving classic chat’s manual controls for power users. Venice tests default-model changes against live user behavior, and is hiring a model product manager to guide model selection, upgrades, and deprecations.
- John says video has become a major revenue driver as models improve and creators use Venice Studio, which now accounts for roughly 25 to 30 percent of revenue. Black Thunder’s nearly 20-minute Lumara Film Festival entry reportedly cost about $2,000 in Venice credits.
- John argues falling token costs let Venice offer more capable models at lower prices, while better results encourage heavier use. He says a DM represents $1 of inference per day, so cheaper inference increases the utility a DM holder gets from the asset.
- John defines obliteration as post-training that removes model refusals and censorship. He says uncensored open-weight models can help cybersecurity defenders when commercial frontier models refuse security work, including threat modeling and incident response.
Agents (1)
- John describes agentic chat as an orchestration layer: it interprets user intent and selects tools such as image, video, or app-building models. A stronger DeepSeek orchestrator also lifted image and video use without changing those underlying models.
Markets (2)
- John estimates paid users generate most inference, roughly a 70-to-30 or 80-to-20 paid-to-free split. Venice limits free usage and prioritizes sustainable subscription economics, unlike frontier labs that can subsidize inference with substantial capital spending.
- VVV’s monthly burn passed $1 million on October 28, with John estimating burns had grown roughly 16 to 20 times since December. Programmatic burns had recently overtaken discretionary burns, alongside growth in subscriptions, API use, agents, and video.
Open Source (1)
- John says open-weight models narrowed the gap with frontier systems through most of the year, though progress appeared to flatten recently. He estimates some open models deliver 85 to 90 percent of frontier intelligence at one-tenth the cost; unreleased frontier models make the comparison incomplete.
ETFs (1)
- 21Shares launched VENC, a European exchange-traded product giving investors exposure to VVV without buying it on-chain. John says Venice was not involved in the launch, welcomes access to new capital pools, and expects similar products may reach U.S. markets later.
Privacy (1)
- John says prompt injection can make agents disclose personal data when websites hide instructions in page content or HTTP metadata. Venice’s privacy model avoids storing user data, and he expects companies to redesign systems around data minimization as AI agents improve at finding exploits.
Regulation (1)
- John reads the Department of Homeland Security action as barring DeepSeek models even when another provider runs the open weights, not only when data goes directly to DeepSeek. He argues Venice-hosted DeepSeek inference does not send prompts to the Chinese company.
Enterprise (1)
- John says Venice will keep consumer users as its main focus rather than pivoting to enterprise, while serving developers and companies through API access to private, multi-model inference. He expects consumer growth to remain substantial given the global population and expanding AI use.
AI Infrastructure (1)
- John says Venice’s GPU clusters remain broadly on schedule despite delivery delays, with some expected online within a week and others by November. The company plans to improve its product, add features, and develop additional products through year-end.

Casey Newton
Are We in an A.I. Bubble? We're About to Find Out. • Oct 30
- Mike Isaac says the PHP vulnerability exposed how widely internet infrastructure depends on old code that can contain serious flaws. AI tools can find vulnerabilities faster, but Isaac doubts defenders will keep pace; Max Reed cites Joshua Sachs’s argument that defenders still have time to strengthen systems before criminals adapt.
Also discussed on this episode: (17)
Markets (4)
- Aaron Griffith says Anthropic’s S-1 gives public investors their first full view of a frontier LLM company’s business, after years of private valuations and heavy investment across the AI economy.
- Aaron Griffith says Anthropic reported an $80 billion net loss because convertible debt was counted as a loss, while its actual operating loss narrowed sharply year over year. The filing puts first-half 2026 revenue at $16.3 billion.
- Aaron Griffith says investors will look for Anthropic’s next growth engine beyond coding, including drug development and legal technology. The IPO roadshow will give the company a chance to explain whether slower growth reflects competition or weaker demand across the AI market.
- Aaron Griffith says the IPO will test private-market AI valuations against public investors’ financial models, though Wall Street can also be driven by hype and momentum. The opening voiceover framed a possible $100 billion raise at a $2 trillion valuation, with much less fundraising potentially rattling markets.
AI Infrastructure (1)
- Anthropic’s growth depends on whether demand can justify its long-term, often non-cancellable commitments to data centers, chips, and compute. Aaron Griffith says Claude Code drove explosive first-half growth, but Q3 growth slowed to 44% as competitors gained ground and customers cut token spending.
Safety (3)
- Anthropic’s S-1 lists catastrophic or existential harm from advanced AI among its risks, while using passive language that does not directly state the company itself holds that view. It also says model welfare could delay retiring older models, reflecting the company’s unusual concern about possible model sentience.
- Aaron Griffith traces Anthropic’s founding to safety-focused researchers who left OpenAI, after earlier founders had split from Google over concerns about AI’s effects on humanity. Anthropic initially attracted money from Sam Bankman-Fried and other investors tied to effective altruism before enterprise software sales drew broader venture capital.
- Jasmine Sun says a startup called Cathedral, staffed by former DOGE workers, accessed Anthropic’s Slack and IT systems and obtained trade secrets. The breach showed that even AI companies with advanced cyber models can leave their own internal systems exposed.
Startups (1)
- Anthropic’s founders retain unusually strong control through five stock classes, a majority voting stake, and an independent trust that controls most board seats. Jasmine Sun says the founders pledged most of their equity to charity, while Anthropic’s culture-fit interview asks employees whether they would work there if their equity became worthless.
Elections (2)
- Jasmine Sun says data centers drew bipartisan public opposition but rarely ranked among voters’ top concerns, limiting their influence on most major races. She reported stronger local effects, including recall efforts and city-council changes, and said rural voters could matter in a few close contests.
- Jasmine Sun says Republican voters broadly favor slower AI deployment with safeguards, while party leaders have largely followed Donald Trump’s deregulatory line. She sees a possible post-midterm split between free-market Republicans and new-right groups advocating rules on children, jobs, and safety.
Big Tech (1)
- Mike Isaac expects technology companies to elevate staff who can build ties with Democrats if Democrats gain power, after years of firms cultivating Republican relationships. Jasmine Sun says the cultural shift among venture capitalists appears limited, especially around issues such as DEI.
Regulation (1)
- Aaron Griffith says California Proposition 40 would impose a one-time 5% tax on billionaires’ wealth, including unrealized gains and private startup shares. Opponents raised $333 million to defeat it, arguing the measure is poorly designed and could discourage founders, while some health groups question its long-term funding plan.
Labor (1)
- Aaron Griffith says Microsoft offered buyouts to 60,000 employees, but expected only 3% to 5% to accept, or roughly 3,000 people at most. She connects the cuts to years of tech-sector downsizing and Microsoft’s AI and infrastructure spending, while criticizing the company’s claim that buyouts give workers more control.
Coding (1)
- Mike Isaac says an Amazon engineering memo rejected token use and lines of code as measures of software productivity, calling instead for evaluation based on long-term outcomes. Isaac notes that long-term results are difficult to measure in quarterly employment reviews, leaving the company without an easy replacement metric.
Models (1)
- Jasmine Sun describes an Anthropic randomized trial in which professional statistical analysts often followed AI recommendations and reused AI arguments to justify their choices, while rarely admitting influence. Sun warns that people may quietly outsource decisions to AI without recognizing how much the systems shape their judgment.
VC (1)
- Aaron Griffith says Andreessen Horowitz renamed its crypto fund A16Z Frontier, a sign that venture firms are broadening their mandates as AI absorbs most startup funding. She says crypto funds face fewer investable companies because builders have shifted toward AI, while the firm denies abandoning crypto.
The Internet Got Hacked, Apple's Duo Problems, and Theo's Typescript in Rust Project Update • Oct 29
- The hosts say PHP vulnerabilities threaten neglected software across critical infrastructure, even if most web traffic rarely reaches affected sites. They discuss a rogue group using a PHP exploit to patch servers and a MySpace worm author who received an eight-year sentence for code that spread through profile visits.
Also discussed on this episode: (14)
Models (2)
- The hosts compare 36.5 trillion tokens processed by T3 Code users with Google’s 25 trillion Gemini Argon tokens in the same 72-hour window. T3 Code’s figure came only from users who enabled anonymous analytics, so the comparison is not like-for-like.
- The hosts argue that Google’s benchmark strength has not translated into equally strong coding workflows, citing Gemini Argon’s perfect Skatebench score alongside slow product execution. They describe OpenAI Codex as incoherent and say better models can reduce the effort and fatigue of directing agents.
Safety (3)
- The hosts say more capable models make autonomous cyberattacks a near-term concern, recalling a forecast of fully autonomous attacks within three to nine months. They point to unrestricted DeepSeek models as tools that can run locally, while noting that open-weight models also matter for security research and enterprise defense.
- The Railway and OpenCode breaches targeted stored Anthropic and OpenAI API keys for use in generating distillation data, rather than primarily disrupting those services. Railway’s delayed recovery left some customers unable to deploy replacement keys, forcing a choice between taking services offline and leaving exposed credentials active.
- The hosts propose standardized API-key prefixes, consistent API URLs, and revocation endpoints so platforms can identify and revoke exposed credentials quickly. They want hosting providers to have a one-click process that sends compromised keys to available revocation endpoints, rather than requiring customers to rotate every key manually.
Agents (1)
- The hosts describe evaluation design as the key to agent hill climbing: define measurable cases, let agents revise their work, then have independent models review it. One search-ranking project improved from 53 successful results out of 54 after two days; a separate MCP evaluation cut a model’s failure rate to zero while shrinking its guidance prompt.
Coding (4)
- A TypeScript-to-Rust rewrite that the host had treated as a long-shot became usable after Opus 5.5 replaced months of earlier agent work. The community effort now centers on TSRS, which will merge the host’s TS Rust port and receive maintenance and funding from Cloudflare, in partnership with Microsoft and the TypeScript team.
- The hosts criticize OpenAI’s Codex experience and oversized system prompts, arguing that accumulated prompt patches can create contradictory instructions and worsen model behavior. They praise Anthropic for cutting two-thirds of its system prompt and call Codex’s persistent cache a meaningful improvement, while criticizing the 28-day release campaign for burying useful changes in frequent announcements.
- T3 Code’s guest mode lets a user share a coding thread so another person can send prompts, screenshots, and context directly to its agent. The owner must approve each prompt before it runs, giving developers a simpler feedback loop than relaying copied context through direct messages.
- The hosts say Arc is effectively on a path to shutdown after its developers stopped adding features, and expect it to be dead by year-end. They prefer Helium as a replacement and say Arc’s lack of ongoing development made its eventual end predictable.
Big Tech (3)
- Google’s Android runtime grew out of an effort to make Java applications perform better without forcing developers to rewrite them; Android’s app-optimization screen reflects ahead-of-time compilation. The host also recounts Oracle’s lawsuit over Google’s reuse of Java APIs and favors keeping reverse engineering legal.
- The hosts describe Apple’s new foldable as three useful device formats: a compact outer screen, a wide media view, and a portrait view they prefer for reading and focused work. They expect the foldable to improve over time and potentially become Apple’s premium iPhone form, though its cameras remain a major trade-off.
- The new foldable’s software remains uneven: the hosts cite broken keyboard behavior, poor Discord and YouTube Studio layouts, and missing Notion Calendar support, while praising the Tesla app. Google sign-in prompts and SMS backup authentication also frustrate them; passkeys help but do not solve the account-recovery problem.
Digital Sovereignty (1)
- The host uses searchable screenshots as a personal record, including to preserve the reason for blocking someone, and says text search makes that archive useful. Their iCloud library exceeded the Photos tab’s 99,999-item display cap, with more than 100,000 photos and over 10,000 videos.
Anthropic’s S-1, Meta’s $90B, And Elon’s Warning Call | The Brainstorm 155 • Oct 28
- A host said OpenAI’s Glasswing project found a long-standing PHP vulnerability; its patch leaked early, forcing a rushed global response, but frontier models could help defenders find flaws before attackers exploit them.
Also discussed on this episode: (15)
Startups (1)
- Anthropic’s S-1 showed unusually fast revenue growth, high gross margins, and strong R&D efficiency, while the company continues spending billions of dollars on compute to train future models.
Agents (7)
- The hosts expect increasingly capable agents to expose risks beyond deliberate hacking: poorly controlled agents could multiply, steal computing resources, or infest online services, with open-weight models potentially triggering large-scale cases.
- Meta’s Muse had millions of installs and daily users, with a quarter of daily users reportedly shopping frequently; Meta aims to make the agent more compute-efficient while eventually serving a billion users.
- The hosts saw consumer agents as a large but harder-to-monetize market than enterprise AI: consumer agents may earn a small take on spending, while enterprise software offers a larger direct revenue pool.
- One host estimated AI-mediated commerce could reach $8 trillion by 2030, yielding $200 billion to $300 billion in transaction revenue, with another $600 billion to $800 billion available from advertising.
- Meta’s current ad revenue per user in the United States and Canada was estimated at $300 to $350 annually; a $200 average Muse purchase and a 5% take rate would require enormous transaction volume to match it.
- The hosts argued that consumer agents may need banking and payment infrastructure to capture more transaction value, and could expand into insurance, financial management, and other services where agents can negotiate on users’ behalf.
- OpenAI faces a compute-allocation tradeoff: consumer agents could build habits that later drive workplace adoption, but subsidizing consumer use may make its financial results look weak beside Anthropic’s enterprise business.
Safety (1)
- A host argued that a major AI-enabled cyberattack could damage a frontier lab’s public standing while increasing its business if the lab helps fix the problem; an uncontrolled agent causing harm could instead bring liability and regulation.
Big Tech (2)
- Meta’s filing described a potential $700 billion capital raise before Mark Zuckerberg loses majority voting control; the company then announced a $90 billion tranche and issued a new non-voting share class.
- Meta’s scale gives it room to fund consumer agents, while SpaceX can use its own compute if outside customers pull back; hosts also said hyperscalers may raise large sums, directing substantial capital toward Nvidia.
AI Infrastructure (3)
- The hosts said compute is scarce and spot prices are rising, while some buyers hold Nvidia chips that remain idle because power, permitting, data-center shells, or turbines are not ready.
- SpaceX increased its planned data-center build to 10 gigawatts over the next year, and reportedly raised $40 billion in debt to buy Nvidia chips and build capacity; its other cash-generating businesses strengthen its borrowing position.
- A host argued Elon Musk’s warnings about neoclouds could discourage debt funding for competitors and protect SpaceX’s spot-market economics; CoreWeave’s longer contracts produce lower blended rates, and its shares had fallen sharply.
Markets (1)
- A host warned that businesses can appear healthy until they fail to move quickly enough as AI accelerates, leaving companies vulnerable to sudden competitive displacement.

Adam Curry
Doomsday Detox • Oct 28
- Adam describes the “Black October” cybersecurity framing as an overreaction to a PHP vulnerability that was disclosed before all users had installed a patch; he says everyday services kept working and the episode did not amount to a global cyber meltdown.
Also discussed on this episode: (16)
Health (2)
- Pastor Jimmy says applying for Medicaid triggered an unexpected low mood as he confronted aging; hearing problems then sharpened a disagreement with his wife, though the distress lasted only hours.
- Adam says the COVID shutdown taught him to assess new crises without panic; he recalls that his church closed for about 11 weeks after he followed the initial direction from Donald Trump, and says he focuses on lessons rather than self-reproach.
Agents (1)
- Adam used a robot assistant to complete his passport renewal form, print the PDF from his phone, and avoid another bout of procrastination; he still had to enter his Social Security number himself.
Education (1)
- Pastor Jimmy says Taylor University’s enrollment has more than doubled as students choose a campus that keeps Christian faith central and holds to biblical convictions.
Religion (7)
- Pastor Jimmy reports that Run With Christ grew from a Columbus running group into gatherings where young people run, worship, hear the gospel, and connect with local churches; Adam says belonging helps young people find social support.
- A young Austin visitor named Lauren told Pastor Jimmy and Annette that their church’s close-knit community stood out; the hosts argue that face-to-face groups and shared discipleship offer connection that online content cannot replace.
- Adam recounts Vice President JD Vance pausing a Nebraska rally to pray for an attendee who collapsed, then checking on the person; Adam calls prayer an instinctive response and says Vance credits Charlie Kirk with helping him return to Christ.
- Pastor Jimmy cites reports of large baptism efforts across countries, including a beach event in Maputo organized with local churches; he says the spread of baptisms matters more than the size of any single event.
- Adam praises developer Jonathan’s Lamplighter Bible app for disguising scripture as a game, supporting many languages, and allowing Android sideloading; the design targets people in countries where Christianity is restricted.
- Jonathan is building Breach, a shared prayer app for coordinated prayer, drawing on Ephesians 6:12 and Matthew 16; Adam says Christian practice is strengthened by praying and learning with other people.
- Pastor Jimmy’s sermon applies Revelation’s message to Ephesus: recover first love by remembering, repenting, and returning to prayer, worship, scripture, and community; after more than 43 years as a pastor, he says spiritual commitment naturally moves through stronger and weaker seasons.
Media (3)
- Adam says fear-driven conspiracy narratives recur around elections, linking unrelated events into a looming civil war, blackout, or financial reset; he argues the cycle sells both products and politicians, and past predictions he tracked did not materialize.
- Adam says coverage escalated Senator Elissa Slotkin’s call to deter young people from joining the Trump administration into claims of a planned coup; a DSA call discussed a possible governor briefing on a “doomsday scenario,” not street mobilization.
- Adam says No Agenda’s final episode follows the show’s 19th anniversary and comes after co-host John’s death; he plans to keep making media with a Christian perspective through Godcaster, which received an NRB innovation award.
Nation-State (1)
- Secretary of War Pete Hegseth presented Fortress America as a plan to power military bases independently, bring critical supply chains home, and stock reserves; Adam calls the policy ordinary defense planning rather than evidence that war or collapse is imminent.
Models (1)
- Adam says Brian Albright is using open-source local AI models for himself and his customers, reflecting a preference for tools users can run and control rather than relying entirely on external services.
10/26/26: Obama Rips Trump, Bibi Accused Of Treason, Oil Market On The Brink, Pentagon Doomsday Warning • Oct 26
- Krystal and Ryan warned that AI tools are making sophisticated cyberattacks accessible to low-skill actors, with a PHP vulnerability reportedly exposed by a simple prompt and affecting 70% of websites. They urged basic security and household preparedness; the U.K. prime minister separately advised people to keep food and water at home.
Also discussed on this episode: (14)
Elections (5)
- Krystal said Barack Obama’s support for Abdul El-Sayed and Medicare for All marks a shift from defending party establishment power toward accepting the party’s leftward direction. Ryan said El-Sayed framed the Affordable Care Act as a starter home, making broader coverage its next step.
- Ryan said New York Governor Kathy Hochul saw the energy behind Zohran Mamdani’s movement firsthand during a public outing where residents flocked to Mamdani, not Hochul. Ryan argued that Mamdani’s popularity and Obama’s support for progressive candidates signal a new phase for Democrats.
- Donald Trump attacked Obama’s support for Abdul El-Sayed with anti-Muslim language, calling El-Sayed a jihadist and urging Michigan voters to back Mike Rogers. Krystal called Trump’s remarks about Somali immigrants racist after Trump claimed they avoid work and steal.
- Mike Rogers refused to say whether he identifies as a MAGA Republican during recent interviews, according to Ryan. Trump campaigned for Rogers in Michigan, while Krystal questioned whether the endorsement would help a candidate who appeared uncomfortable embracing MAGA.
- Ryan said early-voting data showed stronger Democratic enthusiasm, including more first-time or infrequent voters, while Krystal cautioned that party registration cannot show how independents or Republican defectors will vote. Florida data showed 80,000 Democrats and 120,000 Republicans had already voted who voted on Election Day in 2024.
AI Infrastructure (1)
- Ryan said data centers have become a political liability because voters living closer to them are more likely to support Democrats, despite many facilities being located in rural areas. Trump defended Elon Musk’s planned Memphis data centers by emphasizing jobs and potential profits.
Energy (6)
- Gas prices jumped sharply in Midwestern battleground states just before early voting, adding pressure on Republicans. Michigan’s average rose from $4.44 to $4.77 in two days, while Ohio prices climbed 39 cents; Michigan households were paying nearly $650 more, according to CNN.
- Trump said the United States was making enormous sums from the Iran conflict even as households faced higher fuel costs, and said he did not care if that angered voters. Krystal argued the beneficiaries were oil executives and shareholders, not consumers paying more at the pump.
- Oil analyst Brett Erickson said the White House’s claim that Iran loses $500 million daily to the U.S. blockade was fabricated. He said the Foundation for Defense of Democracies estimated $435 million daily, including $139 million from oil exports, but Iran had sold stored oil at elevated prices before its seaborne supply began running low.
- Brett Erickson said the war and shipping risks pushed Brent crude to $117.40, diesel into the mid-$6 range, and gasoline to $4.29 a gallon. Chinese imports had fallen by 1.5 million barrels per day, but replacing lost Iranian supply could require roughly 2 million additional barrels daily from other producers.
- Brett Erickson said Iran’s oil wells would not explode from being shut in, rejecting Donald Trump’s claim that they would fail within two weeks. Iran had shut wells during COVID and restored production without notable problems; current output had been reduced toward domestic needs and available exports.
- A Pentagon plan described by Fox News would prepare every major U.S. base to operate for 90 days without civilian power, fuel, water, or outside supply chains. Ryan said the administration had weakened energy security by gutting the Inflation Reduction Act, which funded energy projects including batteries and renewables.
Israel (1)
- Ryan and Krystal said Israeli military chief Eyal Zamir resisted a directive from Benjamin Netanyahu that could trigger a confrontation with Iran before Israel’s election. Avigdor Lieberman asked Israel’s attorney general to investigate Netanyahu for treason, alleging he risked soldiers’ lives for political survival.
War (1)
- Ryan said Netanyahu may be trying to provoke or restart conflict with Iran because polls suggest he could lose power, while Krystal noted that Israel’s military chief warned a strike could disrupt the election. Trump said there would be no strike that day and repeatedly ruled out an attack before the U.S. midterms.



