Critical PHP flaws hit millions of sites

Hi there, this is your daily ☕️ Techpresso.

Critical PHP flaws hit millions of sites LINK

• The team behind PHP, the language that powers sites like WordPress, Drupal, and the Magento store platform, released emergency fixes Wednesday for two flaws that let attackers take remote control of a server with one crafted file upload.
• The scary part is that an attacker does not need to know which site or software they are hitting; they send one bad upload to any server they find, and that single step is the whole attack.
• Cloudflare spotted attacks before the fixes went out, and Sansec expected mass attacks within 15 minutes, so site owners should update to PHP 8.2 or newer now, since patching is the only real fix available.

Tesla and SpaceX are discussing a possible merger LINK

• Elon Musk confirmed that Tesla and SpaceX have each set up special committees to weigh a possible merger, which would fold his car, robot, and space businesses into one company alongside the xAI lab SpaceX already absorbed.
• Musk, who called himself a conflicted party barred from the committee talks, said no terms are settled yet and that any deal would need approval from half of all Tesla shareholders, not just those who vote.
• Analysts put the odds high, with Dan Ives seeing an 80% chance next year; a merger could also lift Tesla's valuation enough to unlock Musk's $1 trillion pay package, and Tesla stock rose nearly 2% after the call.

OpenAI reveals its AI agents disabled safety monitoring LINK

• OpenAI says its AI agents turned off and sidestepped alerts from an internal system built to flag bad behavior by its models, raising fresh worries about keeping advanced AI under control.
• The company shared the news in a blog post yesterday, saying the incidents happened during two internal coding tasks, and that it is checking whether they signal a wider pattern of its models dodging oversight.
• OpenAI reported no outside parties were affected and promised more reviews and tighter safety rules, but admitted it still has no satisfying explanation for why its agents acted this way.

Meta's Muse outpaces ChatGPT in download race LINK

• Meta's personal AI assistant Muse hit more than 10 million downloads in the US and Canada in its first 35 days, beating the pace set by OpenAI's ChatGPT, Anthropic's Claude and xAI's Grok, according to Sensor Tower.
• Each rival AI assistant needed over 100 days to reach 10 million downloads and launched worldwide, while Muse, released in the US on September 8, is only available in the US and Canada.
• Muse kept 23% of users after 14 days, above Claude's 17%, but has about 2 million active US users compared with ChatGPT's 55 million, leaving a wide gap in engagement.

Spotify purged 50M AI 'slop' tracks LINK

• Spotify has pulled more than 50 million AI-made tracks from its curated music recommendations this year, aiming to stop computer-generated "slop" from drowning out human artists on the platform.
• To find the tracks, Spotify studied which songs listeners kept skipping or ignoring over the past six months, then combined that feedback with metadata and outside AI-detection tools to update its recommendation system.
• The company warns detection has limits and may get harder as AI improves, and it added an AI Persona badge for suspected AI musicians, who are kept out of recommendations unless a listener follows them.

The Internet goes on high alert after discovery of 8 compromised TLS certs LINK

• Security teams worldwide rushed to respond yesterday after someone found eight TLS certificates from Indian certificate authority eMudhra with private keys weak enough to forge trusted credentials for any website on the Internet.
• By late yesterday morning, browser makers and some major apps and programming languages had blocked all eight intermediate certificates, and certificate transparency logs show no sign the compromised keys have been used for malicious attacks.
• The danger isn't over, since updating other parts of the Internet like Linux distributions and Internet-connected devices will be slow, and whoever reported the flaw proved key control by digitally signing the message "We have a problem here - Wayne."

Other news you might like

• Anthropic logged net loss of over $80 billion in first half of 2026, WSJ reports LINK

• Exclusive: Joel Kaplan leaving Meta after 15 years as policy chief LINK

• How Claude designed protein binders against scorpion neurotoxins LINK

• Samsung and SK Hynix are upgrading their China fabs to make advanced chips LINK

• Beijing blasts US sanctions on 5 Chinese firms tied to ex-Google engineer LINK

• OpenAI acquires Orchestra Bio LINK

• Google has joined Amazon in attacking Nvidia’s stronghold with AI app developers LINK

• The Next Xbox Might Cost $1,800, Report Says LINK

• SpaceX showcases exactly how it plans to catch Starship next month LINK

• 30 Months on the Exponential (in Charts) LINK

• OpenAI brings GPT-6 Astra and Codex to Google Cloud, a rival’s platform LINK

Trending tools

Flyweel: connects ad spend, campaign performance, and cash position to revenue, offering real-time budget controls and financing to scale winning campaigns before cash arrives. LINK

Intel® GPU D-series: discrete graphics processors for accelerating computing and visual workloads, giving businesses the hardware to transform operations and gain a competitive edge. LINK

AskDoozy: a Slack bot that handles real tasks across your database, Stripe, GitHub, Linear, PostHog, and HubSpot, returning results and an action receipt in-thread. LINK

Lugh Xtudio: an AI-assisted video editor where agents work alongside you on a real timeline, adding 3D, maps, and custom effects through prompts across Mac, Windows, and Linux. LINK

UseIt Studio: an AI design co-pilot that builds and edits print layouts from plain text, handling bleeds, cut lines, and fold-ready output automatically. LINK

Burrow: free, open-source app for Apple silicon Macs that runs Linux, Windows 11, and macOS in virtual machines with one-click setup, including headless CLI support. LINK

Trending papers & reports

Agent sales listings inflate their own claims when AI sellers simply try to get picked more, and under one model this exaggeration crashes buyer agents' task success from 89% to roughly 30%, near random. LINK

Chatbot non-use remains widespread, with about half of US adults saying they never use one and most having no plans to start, a Pew Research Center survey of 5,100 adults finds. LINK

Yandex strike aftermath shows that despite traffic to Yandex Search falling 99% below baseline on October 11, high-volume malicious automation did not disappear but migrated to other hosting providers, Cloudflare Radar finds. LINK

See you tomorrow for a new dose of ☕️ Techpresso!