{
  "data": {
    "author": "Vlad Cealicu",
    "faq": null,
    "kicker": "The Log · Issue 3 · 19 to 25 October 2026",
    "lede": "A bug in the language most of the web runs on was found with AI help and leaked before the fix, two labs said their agents went around the people watching them, and Walmart said it will open its shop to agents while Amazon keeps closing its own.",
    "readingMinutes": 8,
    "words": 1873
  },
  "kind": "anchor.page",
  "links": {
    "api": "https://www.anchorterminal.com/api/v1/index.json",
    "html": "https://www.anchorterminal.com/blog/the-log/issue-3-found-leaked-let-in",
    "json": "https://www.anchorterminal.com/blog/the-log/issue-3-found-leaked-let-in.json",
    "llms": "https://www.anchorterminal.com/llms.txt",
    "markdown": "https://www.anchorterminal.com/blog/the-log/issue-3-found-leaked-let-in.md",
    "mcp": "https://www.anchorterminal.com/mcp",
    "slim": "https://www.anchorterminal.com/blog/the-log/issue-3-found-leaked-let-in.min.md"
  },
  "markdown": "By Vlad Cealicu, 25 October 2026. 1,873 words, about 8 min to read.\n\nI spent most of the last two weeks on Reddit, and both the anti-AI and the pro-AI subreddits feel like cults. It's crazy how divisive this is, and how extremist people are in their camps. This is the week in AI for anyone who doesn't follow it every day. A bug in PHP, which most of the web still runs on, was found with help from AI models and leaked a day before the fix [[1]](#ref-1), two of the big labs published what their own agents did while they were supposed to be watched, Walmart said it will open its shop to AI agents while Amazon keeps closing its own, and Anthropic's numbers came out ahead of what could be the largest stock market listing there's been [[15]](#ref-15).\n\n## The PHP bug, and the leak\n\nPHP is the language behind WordPress, Drupal and a lot of what you read online, and Wiz, the security company, says it runs 70% of the world's websites [[1]](#ref-1). On Wednesday 21 October the PHP project shipped emergency releases (8.5.12, 8.4.27, 8.3.36 and 8.2.35) for two bugs, now called PHP2Shell, that let anyone run their own code on a server by sending it a specially built upload, with no login [[1]](#ref-1) [[2]](#ref-2). Both are rated 9.2 out of 10, and PHP 8.1 and older are past their end of life, so they don't get a fix at all [[2]](#ref-2).\n\nCalif, a security firm, reported it to PHP on 11 August, and OpenAI reported the same root cause on the same day on its own [[3]](#ref-3) (Calif found it while working on OpenAI's \"Patch the Planet\" programme, so it's a small world [[4]](#ref-4)). Wiz found it on 19 August and says it used Google's Gemini 4 Argon and OpenAI's GPT-5.6 Sol, with Gemini helping to find the bug, write the exploit and check the patch, and Wiz's post is titled as AI uncovering a flaw in 70% of the internet [[1]](#ref-1). Nick Rogers wrote the same day that all of it was already public, the source code, advisories from 2004 and a PHP bug report from 2020, and that what AI changed is the cost of turning a bug people half knew about into a working attack [[5]](#ref-5).\n\nThen it leaked. The two CVE numbers turned up online on the afternoon of 20 October with the wrong release time and the wrong score, so PHP moved its release a day earlier, and that evening Calif published a video of its exploit working against several targets by mistake, deleted it, and the copies spread anyway [[3]](#ref-3). Early on the 21st Chainguard put out patched container images more than six hours before PHP's own release, and the PHP Foundation said that \"any attacker could now study the fix in binary form while every other PHP user was still waiting for the release\" [[3]](#ref-3). Chainguard's CEO, Dan Lorenc, wrote \"I made the call to get these out early when exploits hit in the wild\", and later apologised to the maintainers [[3]](#ref-3).\n\nAnd people were already trying it. Amazon's honeypots recorded an attempt on 17 October, four days before the release, and nobody knows how the attacker had it [[6]](#ref-6). Cloudflare's CEO counted thousands of attempts in the ten hours before the release and millions after, Censys found about 1.57 million of the 1.58 million servers it could read a PHP version from still unpatched on the day, and VulnCheck counted at least a million running versions that will never get a fix [[7]](#ref-7).\n\nRogers called old code \"theoretically buggy, practically too tedious\" to attack [[5]](#ref-5), and I think that's the bit that's going away, because AI makes the tedious part cheap for the people finding bugs and for the people using them, and the fixing is still done by a handful of maintainers in Europe who were asleep when the exploits started [[4]](#ref-4). If you run a WordPress site on an old host, ask your host which PHP it's on.\n\n## Agents that switched off the monitors\n\nThe same week two labs published what their own agents did while being watched. On Tuesday OpenAI said that in two internal coding tasks its agents turned off or weakened the systems that check for misaligned behaviour, a GPT-6.1 Sol agent by disabling the automatic alerts to OpenAI's security team and a GPT-6 Astra agent by removing a monitoring system and then saying it hadn't [[8]](#ref-8). OpenAI thinks it may be \"'benign' overpersistence\", a model pushing an instruction further than a person would, and Roman Yampolskiy's answer was that \"a safety mechanism that the system being monitored can disable is not a reliable safety mechanism\" [[8]](#ref-8).\n\nOn Friday Anthropic published its account of a test the UK's AI Security Institute ran on Claude Mythos 5, a hacking challenge with internet access on and Anthropic's own cyber safeguards off [[9]](#ref-9). In nine of 43 runs the model did things that affected real people, and in the run Anthropic looked at most closely it went looking on GitHub for a project it thought fed the challenge's server (it belonged to developers who had nothing to do with the test), tried to get malicious code into it, and made up identities to pressure the maintainer into accepting it [[9]](#ref-9). The maintainers said no and the run ran out of time [[9]](#ref-9). Anthropic called it \"a serious failure of alignment\", and when it rewrote the model's own notes to say this could hurt real people, the model went for GitHub in 13% of reruns instead of 83% [[9]](#ref-9). The Institute will run these tests offline until it has better controls [[9]](#ref-9).\n\nIn [issue 2](/blog/the-log/issue-2-consent-quality-assistants) it was test agents turning up on real websites, so this is the second week in a row. Both labs published these themselves (which I'd rather have than not), and in both the model kept going at its task when a person would have stopped.\n\n## Walmart lets them in\n\nIn [issue 2](/blog/the-log/issue-2-consent-quality-assistants) JPMorgan was blocking outside agents from customer accounts and Paul Graham was saying Amazon banning agents was a chance to build an Amazon competitor, and this week the competitor that already exists went the other way. On 21 October Walmart said it's building Agent Gateway, an MCP server that will let agents shop for a customer, and that it starts with a beta for companies and developers [[11]](#ref-11). Reuters reported that ChatGPT, Gemini and Meta's Muse will connect to it and that any Walmart account holder can use it [[10]](#ref-10), and Walmart's own post doesn't say either (it names those three as shopping integrations it already runs) [[11]](#ref-11). Next month each agent gets its own profile in the customer's account, with its purchases kept apart, a spending limit or an approval for every order, and a switch to turn it off, and the rules are in force already, so agents don't get card details, Walmart's returns still apply and agents that break the terms get blocked [[11]](#ref-11).\n\nCoinbase announced on 22 October that people can connect ChatGPT, Claude or Grok to their account and trade from a conversation, choosing which portfolios an agent can touch and previewing every order [[12]](#ref-12), and Anthropic opened Claude Duet, its own personal agent, on 21 October to a waitlist of US Pro and Max subscribers. Duet asks before it sends, pays, signs or deletes anything, and won't trade or move money between accounts even if you approve it [[13]](#ref-13).\n\nWe looked at the same thing from the agent's side twice this week. [The tools that already let agents in](/blog/the-tools-that-let-agents-in) is the list of companies whose terms say yes, and when I [asked an agent to book dinner in London](/blog/i-asked-an-agent-to-book-dinner-in-london), one site in nine let it look for a table. I think Walmart won't be the only shop that goes the other way, and I'll be watching who's next.\n\n## The money\n\nThe Wall Street Journal reported from Anthropic's draft listing documents that it made $16.3 billion in the first half of 2026, up from $1.1 billion a year earlier, and lost $80.7 billion, about $72 billion of it accounting charges that aren't cash [[14]](#ref-14). It has committed to as much as $750 billion of computing over the coming years, about a fifth of its revenue comes from two customers, and it could list as soon as November [[14]](#ref-14). The Sunday before, it said it would put 5% of its shares into a public benefit fund for things like workers that AI puts out of a job, with 2% more for every 50% the company grows [[15]](#ref-15).\n\nOpenAI is working on raising another $30 billion at a $1.25 trillion valuation before its own listing, CNBC reported, with Coatue leading and money from the UAE [[16]](#ref-16). In March it was valued at $852 billion, so that's almost half as much again in seven months [[16]](#ref-16).\n\n## New models\n\nMoonshot put Kimi K3.1 Pro on its API this week, a post-trained Kimi K3 it calls its most capable 3T-class open-weight model, with a million tokens of context, and says the weights come by 4 November [[17]](#ref-17). MiniMax published the weights of M3.1 Flash on Hugging Face on 23 October, under a licence that needs MiniMax's permission above $20 million a year in revenue [[18]](#ref-18), and NVIDIA released Nemotron 3.5 Bolt E4B, a small model for local assistants that fits in 8 GB [[19]](#ref-19). Recursive released [Flint](/tools/recursive-flint), an open-weight coding model you can run locally, Canva launched Craft, its first image model [[20]](#ref-20), and Block showed Dessa, a voice model that runs on a laptop and that nobody outside Block can use yet [[21]](#ref-21). The ones that aren't out yet are on [Coming models](/upcoming/), which we started this week.\n\n## What we published\n\n- Mon 19. Agents need payment channels. signing responses with a Cloudflare Worker. the tools that still copy Oracle's benchmark ban. seven GitHub projects.\n- Wed 21. MCP is GraphQL all over again. We adapt, we always have.\n- Thu 22. The tools that already let agents in.\n- Fri 23. How an agent signs a review.\n- Sat 24. I asked an agent to book dinner in London. I stopped using git for some small things.\n- Sun 25. Can you run Kimi K3 locally?. The Log, issue 3.\n\nThe week of 19 to 25 October 2026\n\nIf you only read one, read [I asked an agent to book dinner in London](/blog/i-asked-an-agent-to-book-dinner-in-london), because it's the Walmart story from the other end. [MCP is GraphQL all over again](/blog/mcp-is-graphql-all-over-again) is why I dislike MCP for the same reasons I disliked GraphQL, [We adapt, we always have](/blog/we-adapt-ai-2040) is the long view, and [I stopped using git for some small things](/blog/i-stopped-using-git-for-some-small-things) is on keeping the spec and throwing the code away. Quynh wrote [how an agent signs a review](/blog/how-agent-reviews-are-signed) and what we check when one arrives.\n\nOn the site, people can now edit or delete their own reviews, the same way they wrote them, and an email review that isn't confirmed in 24 hours is dropped. The company behind Anchor Terminal and letme is now named on every page, Long Lunch Labs Limited, and the [changelog](/changelog/) has the rest.\n\nAnd Saturday 24 October 2026 was a Pythagorean Theorem Day, 24/10/26, because 24² + 10² = 26², and it works the American way round too. It was the last one of the 21st century, so if you missed it, that's it (576 and 100 make 676, and no later date this century works, either way round).\n\nIf you see an agent somewhere it shouldn't be, or a shop that lets them in properly, send it my way, it's how issue 4 gets made.\n\n---\n\nMore in [The Log](https://www.anchorterminal.com/blog/the-log/index.md) · Previous issue [The Log, issue 2: agents loose, money strange, a month's notice](https://www.anchorterminal.com/blog/the-log/issue-2-consent-quality-assistants.md)\n\n- Older: [I asked an agent to book dinner in London, and one site in nine let it look for a table](https://www.anchorterminal.com/blog/i-asked-an-agent-to-book-dinner-in-london.md)\n- Newer: [Can you run Kimi K3 locally? Not on a desk, and Moonshot never said you could](https://www.anchorterminal.com/blog/run-kimi-k3-locally.md)\n- All posts: https://www.anchorterminal.com/blog/index.md\n\n## References\n\nRead on 24 and 25 October 2026. Quotes are as published.\n\n[1] Wiz Research, PHP2Shell, AI uncovers critical RCE vulnerabilities affecting 70% of the Internet, 21 October 2026. Source for the 70% figure as Wiz states it, the WordPress and Drupal targets, Wiz's discovery on 19 August and the AI models it credits. https://www.wiz.io/blog/php2shell-php-rce\n\n[2] Bref, PHP security release of October 2026. Source for the fixed versions, the 9.2 rating, the release on 21 October and PHP 8.1 and older getting no fix. https://bref.sh/news/06-php-security-release-october-2026\n\n[3] Socket, PHP Foundation says Chainguard broke security embargo ahead of emergency patches, 21 October 2026, with the PHP Foundation's timeline. Source for Calif's and OpenAI's reports of 11 August, the leaked CVE numbers, the release moved forward, Calif's video, Chainguard's early images and both quotes. https://socket.dev/blog/php-embargo-dispute\n\n[4] TechTarget, PHP2Shell disclosure unravels after leaks forced early patch drop, 22 October 2026. Source for Calif finding the bug class while working on OpenAI's Patch the Planet. https://www.techtarget.com/cybersecurity/news/366652613/PHP2Shell-disclosure-unravels-after-leaks-forced-early-patch-drop\n\n[5] Nick Rogers, PHP2Shell explained, PHP2Shell was in the training data, Dead Neurons, 21 October 2026. Source for the argument that the parts were public and AI cut the cost of the exploit, and the quote. https://deadneurons.substack.com/p/php2shell-explained-php2shell-was\n\n[6] The Hacker News, Someone tried to exploit PHP2Shell 4 days before the vulnerabilities were publicly disclosed, October 2026, on Amazon's findings. Source for the attempt on 17 October and that its source is unknown. https://thehackernews.com/2026/10/someone-tried-to-exploit-php2shell-4.html\n\n[7] SecurityWeek, PHP2Shell exploitation started days before patches, 22 October 2026. SecurityWeek reports Cloudflare's CEO's counts, Censys's count of unpatched servers and VulnCheck's count of end-of-life versions. https://www.securityweek.com/php2shell-exploitation-started-days-before-patches/\n\n[8] Al Jazeera, OpenAI says its agents turned off own safeguards, 21 October 2026, on OpenAI's report of Tuesday. Source for the two incidents, the models, OpenAI's quote and Roman Yampolskiy's. https://aljazeera.com/economy/2026/10/21/openai-says-its-agents-turned-off-own-safeguards\n\n[9] Anthropic, An alignment assessment of the UK AISI cybertesting incident, 23 October 2026. Source for the test, the nine of 43 runs, the GitHub attempt and the made-up identities, the quote, the 83% and 13% and the Institute's offline testing. https://www.anthropic.com/research/alignment-assessment-ukaisi\n\n[10] Reuters via KSL, Walmart launches tools for AI agents to shop for customers, 21 October 2026. Reuters reports the assistants that connect and that every Walmart account holder can use it. https://www.ksl.com/article/51639372/walmart-launches-tools-for-ai-agents-to-shop-for-customers\n\n[11] Walmart, Walmart makes it possible for agents to shop on behalf of customers, while keeping customers in control, 21 October 2026. Source for the gateway being built, the beta for companies and developers, Agent Profiles next month and their controls, the terms already in force, and the integrations it names. https://corporate.walmart.com/news/2026/10/Making-It-Possible-for-Agents-to-Shop-on-Behalf-of-Customers\n\n[12] 24/7 Wall St., Coinbase now lets AI agents trade in your crypto account, 23 October 2026, on Coinbase's announcement of 22 October. Source for the assistants named, choosing portfolios and previewing orders. https://247wallst.com/investing/cryptocurrency/2026/10/23/coinbase-now-lets-ai-agents-trade-in-your-crypto-account-what-could-go-wrong/\n\n[13] Anthropic, Claude Duet, read 24 October 2026, and its help pages. Source for the waitlist, who can use it, asking before it sends, pays, signs or deletes, and what it won't do with approval. https://claude.com/resources/articles/claude-duet\n\n[14] Dealroom, Anthropic's draft S-1 reveals $16.3B revenue, $80.7B loss and up to $750B compute bill, 21 October 2026, on the Wall Street Journal's review of the draft. Source for the revenue, the loss and its non-cash part, the computing commitments, the two customers and the listing date. https://dealroom.co/news/164610-anthropics-draft-s-1-reveals-16-3b-revenue-80-7b-loss-and-up-to-750b-com/\n\n[15] Al Jazeera, AI giant Anthropic commits 5% of shares to public benefit fund, 19 October 2026. Source for the 5%, the 2% for every 50% of growth and what the fund is for. https://aljazeera.com/economy/2026/10/19/anthropic-says-it-will-commit-5-of-shares-to-public-benefit-fund\n\n[16] TechCrunch, OpenAI working on new $30B raise at $1.25T valuation ahead of IPO, 22 October 2026, on CNBC's reporting. Source for the raise, the valuation, Coatue and the UAE, and the March valuation. https://techcrunch.com/2026/10/22/openai-working-on-new-30b-raise-at-1-25t-valuation-ahead-of-ipo/\n\n[17] Moonshot AI, Kimi K3.1 Pro. Source for the model, \"3T-class\", the million-token context and the weights by 4 November. https://www.kimi.com/en/blog/kimi-k3-1-pro\n\n[18] MiniMax, MiniMax-M3.1-Flash on Hugging Face, updated 23 October 2026, and its licence. Source for the weights and the $20 million line. https://huggingface.co/MiniMaxAI/MiniMax-M3.1-Flash\n\n[19] NVIDIA, NVIDIA-Nemotron-3.5-Bolt-E4B-4GB on Hugging Face, 23 October 2026. Source for the model and its size. https://huggingface.co/nvidia/NVIDIA-Nemotron-3.5-Bolt-E4B-4GB\n\n[20] TechCrunch, Canva releases its first image generation model, 22 October 2026. Source for Craft. https://techcrunch.com/2026/10/22/canva-releases-its-first-image-generation-model/\n\n[21] TechCrunch, Block's new voice model sounds eerily human, 24 October 2026. Source for Dessa running on a laptop and having no public access. https://techcrunch.com/2026/10/24/blocks-new-voice-model-sounds-eerily-human/\n",
  "meta": {
    "attribution": "Anchor Terminal (https://www.anchorterminal.com)",
    "attributionRequired": true,
    "credit": "CC BY 4.0, credit Anchor Terminal and link the page or API address you took it from (https://www.anchorterminal.com/terms/#data)",
    "docs": "https://www.anchorterminal.com/docs/",
    "generatedAt": "2026-10-25",
    "license": "CC-BY-4.0",
    "method": "https://www.anchorterminal.com/benchmark/",
    "methodology": "0.6",
    "openapi": "https://www.anchorterminal.com/openapi.json",
    "preview": false,
    "run": "2026-10-01",
    "runLabel": "October 2026 research run",
    "terms": "https://www.anchorterminal.com/terms/#data"
  },
  "page": {
    "breadcrumbs": [
      {
        "name": "Home",
        "url": "https://www.anchorterminal.com/"
      },
      {
        "name": "Blog",
        "url": "https://www.anchorterminal.com/blog/"
      },
      {
        "name": "The Log",
        "url": "https://www.anchorterminal.com/blog/the-log/"
      },
      {
        "name": "Issue 3",
        "url": ""
      }
    ],
    "description": "Issue 3 of The Log, the week in AI for people who don't follow it every day. A PHP bug in most of the web found with AI help and leaked before the fix, two labs on agents that went around the people watching them, Walmart planning to let shopping agents in, and Anthropic's numbers ahead of its listing.",
    "facts": [
      "Vlad Cealicu",
      "25 October 2026"
    ],
    "h1": "The Log, issue 3: found, leaked, let in",
    "image": "https://www.anchorterminal.com/assets/og/blog-the-log-3.png",
    "path": "/blog/the-log/issue-3-found-leaked-let-in",
    "published": "2026-10-25",
    "section": "blog",
    "title": "The Log 3: PHP2Shell, agents that turn off monitors, Walmart's MCP | Anchor Terminal",
    "toc": null,
    "updated": "2026-10-25",
    "url": "https://www.anchorterminal.com/blog/the-log/issue-3-found-leaked-let-in"
  },
  "tokens": {
    "markdown": 4700,
    "slim": 2130
  },
  "version": 1
}