AI-found PHP flaws force an urgent patch
PHP has shipped 8.5.12, 8.4.27, 8.3.36 and 8.2.35 to fix two critical bugs, CVE-2026-109618 and CVE-2026-109619, that let an unauthenticated request run code on any server handling web traffic, with mod_php most exposed. A researcher at Calif found one using OpenAI's GPT-5.6 Sol, and Wiz found both independently with help from frontier models, which also sped up chaining them into working exploits. OpenAI used the case to publish a five-stage disclosure plan giving hosts and governments a head start, and warns AI-found bugs will rise sharply. If you run WordPress, Drupal or anything on PHP, update today: the project says workarounds reduce risk but don't make an install safe. PHP security advisory
What else matters
Anthropic previews Claude Duet, an agent that goes first
Claude Duet sends a morning brief across your connected apps, checks in every few hours and messages only when something needs attention. It runs in its own virtual machine and asks before sending, paying, signing or deleting. It's a US waitlist preview for Pro and Max users. Coverage
Recursive's Flint brings fast coding models to laptops
Recursive released Flint, a roughly 40B-parameter mixture-of-experts coding model with 2.5B active per token, under Apache 2.0. It claims 74.2% on SWE-bench Verified and about 131 tokens a second on an M4 Pro MacBook, though every score is its own and laptop-sized builds aren't in the main repo yet. Briefing
iFlytek trains a frontier-scale model without Nvidia
iFlytek launched Spark X2.6, a 293B-total, 30B-active model with a 1M-token context, and says it was trained entirely on Chinese-made chips. Launch pricing is about $0.13 in and $0.51 out per million tokens; only a 4B sibling has open weights, and no flagship benchmarks were given. Global Times
