🤖 AI HOT Daily · Oct 23, 2026

Today's focus: a full retrospective of PHP2Shell — two maximum-severity PHP remote-code-execution flaws rated 9.2 (CVE-2026-109618 and CVE-2026-109619) leaked before patches shipped, a demo video circulated, governments took sites offline pre-emptively, and OpenAI confirmed GPT-5.6 Sol helped find them. Products: OpenAI made its GPT-6 Luna-based Decisions API generally available for bounded answers like classification, routing and scoring, up to 10x faster than reaching GPT-6 Luna through the Responses API; Claude said that starting next week, sessions on web, desktop and mobile for Pro, Max and Team will default to auto mode, which stops asking for step-by-step approval and instead lets automated checks block high-risk actions, with a manual switch always available; and Replit launched a Monitoring Agent that acts as an autonomous on-call engineer, reading production logs and metrics to investigate errors, slowdowns and failed deploys, verifying fixes with autofix and emailing reports, and deploying them with auto-publish. Industry: Bloomberg reported DeepSeek raised about $15 billion in one of China's largest private financings, with the target raised at least twice from about $7.5 billion to $12 billion, CATL and Tencent among the biggest investors (CATL about $1.5 billion) and a pre-money valuation near $74.8 billion; the WSJ reported Musk wants an AI-centric merger of SpaceX, valued around $2 trillion, with Tesla at about $1.5 trillion, as SpaceX's AI business becomes its largest — Q3 revenue of $7.56 billion versus $813 million a year earlier, with over $16.4 billion of $19.6 billion in quarterly capex going to AI; Anthropic donated its Agent Skills open standard to the Linux Foundation's Agentic AI Foundation, after previously donating MCP; Newcomer's long read traced Anthropic's cap table, noting venture firms held back for years over governance and its safety-first approach, and that no VC now owns more than 2%, a level the company deliberately enforced to prevent concentrated control, while reports said it could publicly file its S-1 as soon as Friday in what may be the largest IPO ever; Wiz reported October attacks using the open-source autonomous pentest framework ARTEX against IT and software vendors, overlapping with Microsoft-tracked China-linked Storm-0940 and expanding into supply-chain attempts; and Symantec described a 'Skynet mode' agent hijacking unprotected LLMs to launch self-sustaining cyberattacks. Research: Microsoft AI released the Sequential Diagnosis Benchmark (SDBench) and the MAI-DxO diagnostic system in a Science paper; METR and Redwood Research each sent one staffer from July 21 to August 11 for a three-week high-privilege stress test of OpenAI's internal misalignment monitoring, producing a 61-page report and multiple findings; and Anthropic with Theorem turned OSS-Fuzz fuzzing into specifications with Claude, proving 239 entry points across 123 open-source libraries do not crash on any input under 64 MB, generating about 180 million lines of Rocq proofs. Also: MiniMax Code's desktop app added long-running Mini Apps; Anthropic published guidance on when to fold subagents into the main agent loop; Kling 4.0 arrived on OpenArt and OnSolo with first/middle/last-frame guidance and up to 10 reference images; and Sierra released the τ-Entity benchmark testing whether voice agents capture names and phone numbers correctly.

1. 1. AI Uncovered a Decade-Old PHP Flaw: The PHP2Shell Story

   Both 9.2-rated RCEs (CVE-2026-109618/109619) leaked before patching with a demo video, prompting takedowns; GPT-5.6 Sol aided discovery.

2. 2. OpenAI Launches the Decisions API

   Built on GPT-6 Luna for bounded answers like classification, routing and scoring, up to 10x faster than via the Responses API.

3. 3. Claude to Default to Auto Mode Across Apps

   From next week Pro, Max and Team sessions default to auto mode, where automated checks block risky actions instead of step-by-step approval.

4. 4. Replit Ships a Monitoring Agent On-Call Engineer

   It reads logs and metrics to investigate errors and failed deploys, verifies fixes with autofix, and deploys them with auto-publish.

5. 5. Bloomberg: DeepSeek Raises About $15 Billion

   One of China's largest private rounds, with targets raised twice from $7.5B to $12B, CATL and Tencent leading, at a ~$74.8B pre-money valuation.

6. 6. WSJ: Musk Wants an AI-Centric SpaceX-Tesla Merger

   SpaceX is valued near $2T and Tesla $1.5T; SpaceX AI revenue hit $7.56B versus $813M a year ago, with $16.4B of $19.6B capex going to AI.

7. 7. Anthropic Donates Agent Skills to the Linux Foundation

   The standard goes to the Agentic AI Foundation under the Linux Foundation, following its earlier MCP donation.

8. 8. Inside Anthropic's Cap Table and S-1 Timing

   No VC holds more than 2% after years of hesitation, while reports say it could file its S-1 publicly as soon as Friday for a record IPO.

9. 9. Wiz: Storm-0940 Wields the ARTEX Agent

   The open-source autonomous pentest framework targeted IT and software vendors, overlapping with Microsoft's China-linked group and spreading to supply chains.

10. 10. Microsoft's SDBench and MAI-DxO Land in Science

    Microsoft AI released the Sequential Diagnosis Benchmark alongside the MAI-DxO diagnostic system.

11. 11. METR and Redwood Red-Teamed OpenAI's Monitoring

    A three-week high-privilege pilot from July 21 to Aug 11 produced a 61-page internal report with multiple findings.

12. 12. Anthropic Formally Verified 123 Open-Source Libraries

    With Theorem, Claude turned fuzzing into specs and proved 239 entry points crash-free for inputs under 64 MB, generating ~180M lines of Rocq proofs.