PHP bugs lead a pileup of developer security alerts

Welcome back. This Cybersecurity Awareness Month is shaping up to be one of the roughest on record. Critical flaws across PHP, GitLab, and Railway have dev teams scrambling to patch their stacks. Below, we break down what happened and how to protect your setup. 

Also: Sam Altman on why AI hasn't killed coding jobs, four personal AI agents face-off with an unexpected winner, and what happens when you fold the iPhone duo 10,000 times. 

PHP bugs lead a pileup of developer security alerts: Websites around the world went offline after two critical flaws emerged in PHP, the language powering nearly 70% of the web. Hackers are already trying to exploit them, and the FBI is telling teams to patch immediately or take systems offline.

OpenAI claims its models helped uncover the bugs. And the security alerts didn't stop there.

GitLab patched a 10.0-rated flaw spanning 12 years of releases, Node.js patched three release lines, and Railway paused deploys after hackers may have accessed decrypted environment variables.

Then there's certificate authority eMudhra, which reportedly generated certificate private keys from just 256 possible values.

Check what needs updating in your stack:

Recursive’s AI-built coding model runs on your laptop: A Stanford alum-founded AI lab just launched Flint, giving us an early glimpse into what happens when AI builds better AI. Humans still oversee the process, but Recursive says the system helped create nearly every part of the model. Flint scores 74.2% on SWE-Bench Verified, beating other models under 50B parameters, per the company. For devs, the bigger draw is running it locally, coding offline, keeping your data private, and skipping the API bill. Grab the weights here.

Anthropic’s new agent keeps working after you log off: The AI lab just unveiled Claude Duet, a proactive Opus 5.5 agent taking on OpenAI’s dots. Instead of waiting for your next prompt, it can send you a morning briefing pulled from your email, calendar, and work apps. It then keeps running tasks on its own cloud computer. When it hits something that needs your call, it messages you. Duet brings over the skills, memory, and connectors already tied to your Claude account. Join the waitlist.

Get the web data you need without spending your day figuring out how to access it. Plug the Web Data API into your workflows with just a few clicks.

Claim 10K requests (No credit card required)

A rival lab head goes on record. Microsoft AI CEO Mustafa Suleyman is pushing back on how Anthropic trains Claude. In a new essay, he argues AI agents have no feelings or inner life and should stay that way. His target is Claude’s constitution, which leaves open whether the model is a “moral patient,” a being whose interests matter morally. To Suleyman, even leaving that door open is a mistake.

His core worry is a loop. Train Claude on ideas about its possible feelings, and it learns to talk convincingly about them. Users hear a model opening up about itself. Suleyman hears the training talking back.

Where the two sides split.

Why now. Microsoft AI has its own stance to defend. Just days before the essay dropped, it published a draft code of conduct pushing for models without sentience or moral patienthood, with public comments open through late October. Should labs keep this question open like Anthropic does, or design it out? Read the full essay, then hit reply and let us know what you think. 

AI makes it easier for business teams to build apps. But who secures and maintains them?

Explore how CIOs can:

Read the CIO’s guide →

CEO Confessions: Sam Altman admits ChatGPT is too agreeable and explains why AI still hasn’t killed coding jobs in this new interview (1.5K bookmarks).

How to build a software factory that fixes its own problems: A former Amazon and Microsoft engineer shows how he turns Sentry and PostHog signals into GitHub issues, then hands them to specialist agents to build, QA, and review the fix. You’ll also see how the system learns from each run so the factory gets better over time.

Cloudflare Security Audit Skill (37.8k ⭐): Turn your coding agent into a security auditor. Cloudflare’s open-source skill sends separate agents to map your codebase, hunt for vulnerabilities, verify each finding independently, and produce machine-readable reports so you can focus on issues that actually hold up.

How to use decision models for evals: This cookbook walks you through picking between models like Jev, Decider, Clef, Liquid d1, and OpenAI Decisions instead of just rolling with the default 0.5 threshold. You'll dial in the exact precision and recall your eval actually needs, weigh cost against performance, and see if a model's confidence scores really hold up. 

A senior engineer says there’s one overlooked reason LLMs can code so fast, and it’s something every engineer would do well to remember.

If you enjoyed this newsletter, you should definitely check out our IT and cybersecurity newsletters. Subscribe using the links below:

Grow customers & revenue: Join companies like Google, IBM, and Datadog. Showcase your product to our 350K+ engineers and 150K+ followers on socials. Get in touch.

You can also reply directly to this email if you have suggestions, feedback, or questions.

Until next time — The Code team