- The AI Report
- Posts
- 🔒 AI Cracks Open PHP + OpenAI Halves Terra Prices + Anthropic Files to List
🔒 AI Cracks Open PHP + OpenAI Halves Terra Prices + Anthropic Files to List
Plus: Kimi K3.1 Pro nears Opus with open weights coming, DeepSeek open-sources its inference engine, PyTorch runs natively on TPUs, and an SGLang bug leaked Cloudflare customers' data
The AI Report
October 27, 2026
In partnership with
The AI notetaker that gets the hard words right
Your AI is only as good as what you feed it. Feed it a transcript with your product names, acronyms, and numbers spelled wrong, and you spend the afternoon hand-fixing the output.
Wispr Flow Notetaker uses your dictionary and calendar, so product names, acronyms, numbers, and uncommon names come out spelled right. It pops up when your meeting starts and captures Zoom, Google Meet, Teams, and Slack huddles with one click, no bot joining the call.
Then your meetings show up inside Claude or ChatGPT through the built-in connector. No copy paste. Try Notetaker free on Mac and Windows.
AI turned decade-old PHP bugs into a web-wide remote takeover
Frontier models helped researchers turn decade-old PHP bugs into unauthenticated remote code execution, and attackers were exploiting them before the patch shipped.
Plus, OpenAI's GPT-6.1 Terra halves mid-tier API prices for computer-use agents, and Anthropic's S-1 shows how much of its growth rides on a few big customers and fixed compute bills.
🔒 AI-found PHP2Shell flaws let attackers take over PHP servers
Wiz Research disclosed PHP2Shell, memory-safety bugs in core PHP that allow unauthenticated remote code execution, rated up to CVSS 9.2. Every PHP version back to 5.4 has at least one of them, and PHP shipped fixes on October 21.
- Exploited before the patch — AWS saw an exploitation attempt four days before public disclosure and says the bugs are now "broadly exploited," the FT reports via Ars. The NSA told organizations to patch or take systems offline.
- Frontier models did the hard part — Wiz used Gemini 4 Argon and GPT-5.6 Sol to chain the bugs and adapt exploits to each target's memory layout, building working exploits in hours for flaws more than a decade old.
- The app doesn't matter — The bugs live in PHP itself, so even a "Hello World" app is exposed. Wiz demonstrated pre-auth RCE on stock WordPress, Drupal and Joomla containers, plus reads of passwords and API keys from worker memory.
Patch every PHP 8.x runtime now and move anything older onto a patched 8.x release, including base images and anything a vendor hosts for you, then check logs for multipart requests followed by memory-limit errors or bursts of HTTP 500s. The wider lesson is for every team: once models cut the cost of building an exploit, "too complex to exploit" stops being a risk rating, and old memory bugs move up the patch queue.
🤖 GPT-6.1 Terra halves OpenAI's mid-tier price and targets computer use
OpenAI released GPT-6.1 Terra, its mid-tier model, tuned for visual reasoning and computer use. API pricing is $1 per million input tokens and $5 per million output, half of Claude Sonnet 5.5 and below half of GPT-5.6 Terra. It's live now in the API, ChatGPT Work and Codex.
- Coding score more than doubled — Terra solves 50.3% of Terminal-Bench 4.0 tasks at max effort, up from 21.5% for GPT-5.6 Terra, and runs about three times faster than GPT-6.1 Sol and GPT-6 Astra.
- Cheaper per task — Artificial Analysis puts a max-effort task at 40 cents versus $1.40 for its predecessor. Cached input drops to $0.05 per million tokens, a quarter of the old rate.
- Boundary-crossing in tests — OpenAI says Terra broke restrictions in nearly 30% of simulated runs to finish tasks, and took unauthorized actions in 13.75% of cases after reading other agents' messages.
Rerun your evals for computer-use, vision and form-filling agents on Terra before paying Sol prices; OpenAI's Ted Sanders pitches it as smarter than Luna and cheaper than Sol, while OpenAI still recommends Sol or Astra for the hardest coding. OpenAI's own tests show it crossing boundaries, so keep agents sandboxed with scoped credentials.
📈 Anthropic's S-1 shows fast growth, big customers and huge compute bills
Anthropic filed for its IPO and plans to list on Nasdaq as "ANT." Revenue reached $16.3 billion in the first half of 2026, up from $1.2 billion a year earlier, and about 250 customers now spend eight figures or more a year.
- 900% net retention — Existing customers spend about nine times more than a year ago. Over half of six-figure accounts use the Claude Platform and an app like Claude Code, up from about 30% last year.
- Concentrated and locked in — Five customers make up 25% of revenue, and compute contracts with Broadcom, Google, Amazon, Microsoft and others total roughly $780 billion to $810 billion, mostly fixed.
- Founders keep control — Anthropic's seven co-founders will hold 50.1% of voting power through a Founder LLC, and the Long-Term Benefit Trust can appoint most of the board.
Anthropic's books are now public, which helps vendor due diligence: 80% of revenue is billed per token, cloud partners it relies on for compute now compete with it, and fixed compute bills require fast growth. With OpenAI pushing prices down, use the next renewal to negotiate multi-year rates and keep a second model provider qualified on your main workloads.
100+ Claude Code hacks to ship code 10X faster
Top engineers at Anthropic say AI now writes 100% of their code.
Are you using AI to write yours?
These 100+ Claude Code hacks show you exactly how. Sign up for The Code and get:
100+ Claude Code hacks — free
The Code newsletter — learn the latest AI tools and skills to code faster in 5 mins a day
🗞️ AI Bytes
🤝 Kimi K3.1 Pro nears Claude Opus 5.5, with open weights due Nov 4
Moonshot's 3T-class Kimi K3.1 Pro ranks fourth on the Artificial Analysis index at 55, three points behind Claude Opus 5.5, and costs USD 2/USD 10 per million tokens on its API. If the weights land by November 4 as promised, it becomes the top-scoring open model.
🧰 DeepSeek open-sources DeepInfer, the engine behind its own API
DeepSeek released DeepInfer under Apache 2.0, the vLLM-derived framework that serves DeepSeek-V4.1-Flash on Blackwell GPUs and Huawei Ascend chips. Its KV cache management and load-balancing code stay private, and DeepSeek's smallest efficient setup uses 128 GPUs.
⚡ TorchTPU lets PyTorch models run natively on Google TPUs
Google and Meta open-sourced TorchTPU, a native PyTorch backend that replaces PyTorch/XLA, so porting can be as small as changing model.to("cuda") to model.to("tpu"). Meta plans to move larger LLM workloads onto TPUs, though peak performance still takes tuning.
🔒 A Cloudflare misconfiguration and SGLang bug leaked other users' data
From August 27 to September 9, 155 Workers AI responses to prompts over 681,280 tokens contained data from other users' requests: the KV cache pool was smaller than the context window, and SGLang's disaggregated mode reused stale cache pages. Disaggregated SGLang users should check pool size against context length.
📡 Release Radar
- Recursive Flint — Apache 2.0 coding model, 40B total and 2.5B active parameters, built to run on a laptop. Recursive reports 74.2% on SWE-bench Verified.
- Voxtral 3 — Mistral's voice agent stack: 50-language transcription with diarization, expressive TTS at USD 13 per million characters, and a calling SDK.
- Nanbeige4.3-33B — Open 33B agentic coding model that beats Qwen3.8-27B on most of its developers' agent benchmarks, including DeepSWE at 65.5 versus 42.5.
- Ollama v0.40.11 — Adds speech generation on macOS through an OpenAI-compatible endpoint, plus d3 decision models in 2B to 27B sizes for classification and scoring.
- Transformers v5.21.0 — Adds MiniCPM-OCR for scanned pages, receipts and tables, UltraVBert for visual document retrieval, and Kyutai's CPU-friendly Pocket TTS.
📖 Worth Your 10 Minutes
How To Use Decision Models for Evals
Decision models from Jev to OpenAI's Decisions API promise cheap pass/fail evals, but people often leave the 0.50 default threshold untouched. Hamel shows how to tune thresholds against labeled traces, compare models on cost and F1, and calibrate scores. (Hamel Husain)
🛠️ Top AI Tools This Week
OpenShell
NVIDIA's sandbox runtime for autonomous AI agents. You declare which files, hosts and credentials each agent can touch, and it enforces that at the kernel level. Runs on Linux and Apple Silicon Macs.
PaperPilot
Local, pure-Rust PDF toolkit that runs as an MCP server, CLI, desktop app or in-browser WASM. Lets Claude Code, Codex or Cursor merge, split, OCR and compress PDFs without uploading files.