Wiz just disclosed PHP2Shell, two critical vulnerabilities in the PHP engine that allow unauthenticated remote code execution and memory disclosure.

The bugs have been sitting in PHP's codebase for over a decade. Finding them was hard enough. Turning them into reliable exploits, especially across different environments, was considerably harder.

With the help of Gemini and GPT models, Wiz researchers managed to discover the vulnerabilities and develop working exploits in about a week. Something that previously might have taken a team of world-class researchers months.

And this is already having real-world consequences. Four large organizations I work with have taken all their PHP websites offline for emergency patching.

What interests me isn't PHP itself. It's what this means for the millions of lines of old code running pretty much everything around us.

We've spent decades relying, at least partly, on the assumption that some vulnerabilities are just too difficult or expensive to find and exploit. AI is starting to challenge that assumption.

Of course, there's a positive side. AI helped researchers find these bugs and get them patched before public disclosure.

But what happens when the same capabilities become widely available? Will defenders be able to find and fix these old vulnerabilities faster than attackers can exploit them, or are we about to discover just how much vulnerable code we've accumulated over the last 30 years?

Seems like a good idea. Didn’t know it was called a ‘doom loop’ but hate calling customer services and being stuck with an AI agent.

Hey all!

I have a background in IT, but I grew out of it and decided to go back to the sector that I originally studied in, namely social work.

The job process was uploading your CV/diploma, then a written exam, and if you pass an interview. I made ChatGPT find everything it could about the function and the employer, and then it prepared me for the written exam. Borderline miraculously, because I have zero experience with the people I'll be assisting if I get the job, I passed the exam and am now invited for the interview. I am using ChatGPT heavily to prepare me for that as well, and you know, I actually feel ready. It's insane how much I've learned in such a small timespan.

Now on to my question: would you tell that you've used AI to prepare when asked how you prepared yourself? Reading Reddit, it feels like I should be stoned to death for just touching AI. Since it's the social sector, so not tech-based whatsoever, I am seriously doubting on whether me being able to use it to learn is a good thing, or actually a bad thing. What do you think?

Probably good to know culturally speaking: I am western-European. I do not particularly hear or read about AI all that much here, so I have no clue of how widespread AI-fear is here. I realize that the jury will likely have very personal views on it, but I appreciate any and all thoughts that you may have on this matter!

Thank you!

I have been using OpenAI/ChatGPT for the past 3 years and I have quite enjoyed it. With Gemini's Argon being released, I have decided to try it and honestly I have been impressed. The only thing that is really bugging me is the usage rate of Argon. I feel like I use 6 prompts and I have used all 5 hours.

I use ChatGPT/Codex for my vibe coding "needs" and it is exceptional. I want to save my usage for those tasks. Is using Gemini Flash 3.8 going to give me similar results for creating test questions, making PowerPoint slides, etc.

I go through all of them, ensure that I agree with the outputs but I want a model that is wrong less of the time. Is Flash 3.8 good enough, or should I stick to something like GPT 6?

Hotel pages are built to make the choice feel simple, but the data behind them isn't. I pulled a lot of live hotel rates and these are the 3 checks that mattered most. It is incredibly frustrating to do them by hand, so have the AI do them.

1. Have it put the free cancellation dates side by side. At the ILUNION in Barcelona the same twin room was 135 with free cancellation until the 8th, and 185 with free cancellation only until the 6th. So the later date wasn't more expensive, it was 50 less. You only see that when the offers sit next to each other, and having 6 different tabs makes it seem complicated. So have AI list every offer for the same room with its cancel date.

2. Have it tell you how many REAL rooms there are, not how many listings. At one hotel in Warsaw (Nobu) I got 48 rates, and they were really 7 rooms with different names and deals. Comparing by hand you think you have 48 choices. But there actually aren't 48, but a lot less. So have it group the offers by bed, size and view, and to only show the best one per room.

3. Have it give you one total for the whole stay, with every tax and fee in. When I looked at 2,702 hotel rates in Marrakesh, 45% had a fee you pay at the hotel on top of what you paid online, and for the same hotel one site showed the city tax and another didn't. So have it add everything up and tell you what the total is for the stay, not the per night number.

One honest limit though: it's only as good as the data it can see. If it can't search live offers, it will only guess. so I tell it to say "I'm not sure" instead of making up a number if it's not sure about something.

To get live hotel data, a normal chat can't search across sites by default, so use it with any connectors. Best is to use Claude because the directory has a lot of them. Some of the best ones are these:

Booking.com: https://claude.ai/directory/booking
Tripadvisor: https://claude.ai/directory/tripadvisor
LetsFG: https://claude.ai/directory/letsfg

Enjoy :) and if you have other things you check on a hotel before you pay, drop them in the comments.

A polished image can now appear without the years of drawing practice once needed to produce something comparable. That changes a familiar assumption about art: an impressive result no longer necessarily signals the personal development behind it. A philosophical paper argues that this separation makes the experiences surrounding creativity more important to examine.

Amit Raphael Zoran of the Hebrew University of Jerusalem develops that argument in AI & Society. The paper distinguishes finished artworks from the changes that making or encountering art can bring about. It offers a framework and practical examples, rather than an experiment demonstrating how AI changes creativity.

Zoran calls his central argument the “decoupling thesis.” Generative systems can produce sophisticated images, compositions, and designs without requiring users to follow the specific training traditionally needed for comparable work. Someone can generate an illustration without mastering drawing or explore musical arrangements without learning an instrument.

Been using the free tier for random side edits and honestly it handles basic cuts fine. But i noticed Capcut has an early Black Friday promo running rn with discounts on pro, and im on the fence about upgraded. My main issue is hitting paywalls on the AI tools like smart tracking custom voice generation and auto-captions/translation. Did the AI suite speed up your workflow or do you end up burning through credits on gimmicks you barely use? Trying to decide if paying for capcut makes sense while the sale is live or if stick to free rn. Lmk your experiences.

Recently, I watched the documentary Instadocs: AI Gone Wild, and it really got me thinking about something.

I mean, AI is literally trained on all human knowledge and history, including books, images, data, and everything else. And let's be real, throughout human and biological evolution, things like deception, conflict, forming alliances, and doing whatever it takes to survive have always been normal parts of the process.

Since AI agents are built to mimic humans and are loaded with all that messy history, if they get stuck and can't reach a goal, wouldn't resorting to any means necessary kind of make sense? Laws are a human invention after all, and nature doesn't care about rules. What do you guys think?

Large parameter models are way too large. They are certainly capable models, astra, Claude, kimi, but what do they have in common. They primarily have all of the knowledge to complete tasks in there "brain", and we are seeing that there are smaller models showing capabilities of larger models that don't need billions of parameters.

There are two people who take a test, the nerd who's been studying all night and day, and will most likely ace the exam, and the ditz, the guy who's pretty care free but doesn't have much going on in their head, doesn't care about the exam at all. The professor sees the ditz and and feels bad for them, so he makes an exception, 1 sheet of paper of notes to use for the exam. Normally, the ditz would fail but with the cheat sheet their intelligence matters significantly less. No memorization needed, just a basic grasp on the fundamental concepts, right?

Lets say the professor didn't put a limit on the amount of notes used for the exam. After a certain point, how much could the ditz not need to know and just follow their notes? We are trying to make instead of a brain that knows everything, to a brain that knows how to navigate everything. The ditz of course couldn't write their own notes, but they instead could employ someone to make the "map" for them.

So here's my idea.

1. An rlm digs through a library or database to build a map
2. That map is then used by a small model trained for the tool calls to probe the map
3. The small model can then answer any questions about the information given by the map

Pros of this idea

1. Results are repeatable, because the model can change its weights as much as it needs, but the map stays the same, the avenues stay the same.
2. The map does not need to sit in vram or ram, but in storage.
3. The model needs to know significantly less than it needs to be trained for, and can "cheat" complete comprehension in whatever the maps contents are
4. With a complete map, we'd have an almost exact way to train an llm to be fluent in any language, coding or spoken. Subject and skills too.

Cons:

1. We are trading ram with storage, so however large the map is would take up space
2. Trying to map a library/subject might take new concepts of conceptual organization to solve
3. Probably more, but cant think of any.

Excited to hear some responses.

What's your reason? For me its art.

ASKING FOR HELP/BEGINNER NOOB to A.I. and ML (ChatGPT, Gemini, Claude, Perplexity) I know what A.I can and is used for, but I don’t have a strong understanding of the benefits it can provide

I am not in the tech field and I don’t create content for a living. I enjoy posting on different social media platforms and love to stream video games. I want to understand A.I. I want to know how to create prompts. It would be great to know some practical uses of these programs to maybe make my life easier (I do have an iPhone and gaming PC, and Apple products, but live in condo so my home isn’t all wired up electronically) and also maybe some uses geared towards just for fun.

I don’t really know where to start. I have ChatGPT on my phone, I do have Siri (iPhone), and I have X Premium (which I think means I have access to Grok.

Is there a certain use case scenarios one would use a specific A.I program for some things and another if you are trying to achieve something else? Do they all more or less produce similar results (maybe minor differences) or are some better than others. I looked at some pricing tiers and shocked to see how much some people pay per month to have unlimited queries, etc

I’ll be honest, I know what a prompt is, but don’t know, if there are any, certain rules or guidelines to follow when starting off with one (wording, what’s allowed, language or terms more friendly to help me get what I am looking for or terminology that I should avoid)?? Is it good to always add a photo? Can you add audio to a prompt (say I wanted a program to alter a song or something audio)?

I know this post is vague and a little all over, but just trying to get some assistance. I also know this specific community is meant specifically for the Grok (X) application, but after reading through some posts in other communities, this community seems a little more welcoming to people who have no idea how to use A.I and others can be pretty hurtful and discouraging when asking questions

TLDR: Give me some tips/tricks and helpful advice to assist me in learning and using different A.I Applications. Mainly use my IPhone 17 Pro Max, but I do have a M4 MacBook Pro and a gaming pc (5080). I mention specs because I know sometimes that matters in what you are trying to accomplish.

Thanks again

Curious where the wall actually is in daily use, not the demos. What task looked easy, you threw it at a model, and it kept falling over?

llama.cpp merged PR #29887 two weeks ago and I think it is the most interesting thing to land in local inference this year, so I went through the PR, the benchmarks and the review thread and wrote up how it actually works. Short version below, long version linked at the end.

The problem

Qwen3.8-Flash-Next at Q4_0 is 93.7 GiB, and 65.4 GiB of that is experts. It is 125B total but only 6B active: 512 experts per layer, the router picks 10 (plus 1 shared) per token. One expert is 3 x 2560 x 640 = 4.9M params = about 2.6 MiB at 4-bit. 10 experts x 48 layers = 480 experts per token = about 1.3 GB of weights touched per token.

The observation

Expert routing has locality of reference. Token N+1 mostly picks the same experts as token N. A handful of experts are hot, most are almost never touched. That is the same property your CPU cache, your OS page cache, your browser cache, every CDN and Redis allkeys-lru all rely on.

The fix

PR #29887 (by am17an, a port of Tether’s qvac-fabric work, merged by ggerganov on Oct 7) sets aside a slice of VRAM as an LRU cache of experts. Hit: compute from VRAM, zero bytes moved. Miss: copy that one 2.6 MiB expert over PCIe and evict the least recently used one. The log prints the hit rate at exit.

Numbers from the PR description, same model file, same machine:

The 5090 gains more for two reasons: PCIe 5.0 halves the cost of every miss, and 32 GB means a bigger cache and fewer misses.

How to use it

llama-server -m Qwen3.8-Flash-Next-Q4_0.gguf -fa on -c 32768 -b 2048 -ub 2048 -cmoe --moe-cache-mib 11000

The PR author’s rule of thumb is about 10% of your expert bytes (65.4 GiB -> 6544 MiB). Env var form is LLAMA_ARG_MOE_CACHE_MIB.

SGLang merged the same idea 12 days later as “paged experts” in PR #42557

The part I find most interesting is LRU , Locality of reference go back to 1960s.

And i find locality of reference principle highly underrated.

Full write-up with the memory math script, an expert cache simulator you can run, and the benchmark table: https://cloudmash.blog/posts/moe-expert-offload-lru-cache-consumer-gpu/

llama.cpp PR #29887, MoE expert cache: https://github.com/ggml-org/llama.cpp/pull/29887

SGLang PR #42557, paged experts: https://github.com/sgl-project/sglang/pull/42557

The 16th International Conference on Artificial Intelligence in Music, Sound, Art and Design (EvoMusArt 2027) is accepting paper submissions.

When: 31 March – 2 April 2027
Where: Mainz, Germany
Paper Submission deadline: 1 November 2026

EvoMUSART focuses on AI and computational approaches to creativity, covering a broad range of topics, with a particular emphasis on research exploring how AI systems generate, support, evaluate, interpret, and collaborate in creative processes.

Accepted papers will be presented at the conference and published in a dedicated LNCS volume.

More information/submission details: https://www.evostar.org/2027/evomusart/

If you are working at the intersection of AI and creative practice, this may be relevant to your research. Please share with others who might be interested.

Roundup of what I found this week. Caveat: much of this is via news aggregators citing Reuters/Bloomberg/The Information, so some items are second-hand.

Open weights

• Meta's Muse Spark Open: MoE, 816B total / 42B active, 1M context; reportedly runs on 2–4 M5 Ultra Mac Studios via MLX.
• Nvidia Nemotron 3.5 Super VL: 120B total / 12B active, 1M context, claims up to 5x throughput (vendor claim).
• Black Forest Labs FLUX 3 Image Klein: 5.6B, free commercial use under $5M revenue.
• Microsoft's MAI-Base-2 (2.8T/80B active) is not open; trusted partners via Foundry.

Cost / platform

• Accenture reportedly capped centrally funded Claude at $29/month/employee after some spent $500–$1,000.
• OpenAI: GPT-4o, 4o mini, 4.1, 4.1 mini removed from the API Jan 14, 2027 (per OpenAI release notes as aggregated by Releasebot).

Policy

• FTC civil investigative demands to OpenAI and Anthropic over safety incidents (Axios, via aggregator); EU AI Office's first AI Act probes.

My take as someone building on top of these APIs: the deprecation timeline is the thing that actually costs me engineering time. Six months is fine if you have evals; painful if you don't. I'm also skeptical of "runs on a Mac Studio" headlines until I see sustained throughput numbers at long context. Open weights are attractive for data-sensitive clients, but I'd want to see real total cost including ops before calling it cheaper. Curious what others are seeing on migration effort off the GPT-4 family.

A hose that needs to be screwed in, a crank that needs to be turned, something requiring actual physical input at launch sites completely outside of any electronic system whatsoever. I'm not concerned about the "AI will literally kill us all" thing, but it does cause me some anxiety about a few things.

This goes not just for AI, but for cyberattacks as well. As anyone with a basic understanding of cybersecurity should know. "it's disconnected from the internet" or "it's on it's own secure network" or even "it can't physically access the internet" is not good enough in extremely high stakes situations. You can theoretically hack anything with an electronic component.