PHP2Shell: CVSS 9.2 Flaws Hit WordPress, Drupal — AI Digest
Two CVSS 9.2 flaws in PHP's core expose WordPress, Drupal and Joomla sites. Also: Recursive Flint, a coding model that fits in 24 GB, HBM prices set to jump 150–200%, and Kling 4.0 in the API.
What matters for you today: on October 21, 2026, researchers disclosed two flaws in the core of PHP rated 9.2 out of 10 — they expose sites built on WordPress, Drupal and Joomla, which covers most small-business websites. If you or your clients run a PHP site, patching it this week matters more than any new model.
Top stories
PHP2Shell: two CVSS 9.2 flaws open WordPress, Drupal and Joomla sites
Researchers disclosed PHP2Shell — two memory-corruption bugs in PHP's own error handling that, they report, allow a WordPress, Drupal or Joomla site to be taken over without logging in.
Wiz rates the flaws CVSS 9.2. OpenAI says its models helped find them through its Patch the Planet program, and that the fix took two months of work with the PHP maintainers. Wiz reached the same finding independently, assisted by Gemini 4 Argon. Cloudflare pushed temporary protection rules to every customer, free plans included, and is already seeing early attacks. The NSA advises organizations to prepare updates and take systems offline if they cannot be protected.
Remote code execution (RCE) is when an attacker runs their own commands on your server without knowing the password.
What it means: business. A salon's or shop's WordPress site is the first target. Cloudflare's rules are a stopgap — Cloudflare itself says they do not replace patching PHP. OpenAI released a Codex skill that checks whether your site is affected.
Sources: disclosure · scope · Wiz · OpenAI · Cloudflare · NSA · checking skill
Recursive Flint: a coding model that fits in 24 GB of memory
Recursive released Flint, an open coding model with 40B parameters of which 2.5B are active per token; LM Studio says it needs about 24 GB of memory to run locally.
The Apache 2.0 license allows commercial use, and the context window is 262K tokens. Recursive claims 54.9% on Terminal-Bench 2.1 and 74.2% on SWE-bench Verified; these numbers have not been independently replicated yet. One user measured 114–132 tokens per second on an M5 Max. OpenRouter offers the model free at launch.
A mixture-of-experts (MoE) model is a model that activates only part of its parameters for each request, which is why a 40B Flint responds at the speed of a small model.
What it means: your wallet. For vibe coding and edits to a client's codebase you get an assistant with no per-request bill, and the code never leaves your machine. I would not put it against cloud agents on hard tasks yet — Recursive itself positions Flint as a complement to them.
Sources: Recursive · LM Studio · results · speed test · OpenRouter · open-source LLM guide
Samsung sold out its 2027 HBM: prices expected to jump 150–200%
According to GSMArena, Samsung has pre-sold about 70% of next year's general-purpose DRAM and 100% of its HBM; HBM is expected to rise 150–200% in price and DRAM by double digits in the first quarter of 2027.
HBM is the high-bandwidth memory inside AI accelerators. Demand was already climbing: Reuters reports that ByteDance, Alibaba and Tencent ordered more than $35B of Nvidia chips. Intel's CTO told Dwarkesh Patel that AI compute has grown 3x a year for a decade, while today's global stock of chipmaking tools would let Intel only double its leading-edge wafer output.
What it means: your wallet. A machine for running models locally will cost more in 2027. If you need one anyway — say, for a clinic that cannot send data outside — there is no point in waiting. Everyone else is better off in the cloud, where many users share one accelerator.
Sources: GSMArena · r/LocalLLaMA on memory · Reuters · Dwarkesh Podcast
Kling 4.0 reaches the API: complex motion and one character across shots
Kling opened API access to its Kling 4.0 video model; the announced improvements are stable complex motion, consistency with a reference character and cinematic camera control.
The model first appeared in fal's interface and agent with the API marked "coming soon", and Kling then announced the official API rollout. Neither announcement lists prices. Reference consistency means the character's face and clothes stay the same from shot to shot — exactly where series of videos with one character used to fall apart.
What it means: client work. A series of clips with one recurring character for a brand becomes realistic without the face drifting between shots. I would price the generation on a test clip before quoting a client.
Sources: fal · Kling · prompt generator for video
OO-Harness and Agent S4: the same model solves 16 points more tasks with a better harness
Two new papers show that the scaffolding around an agent moves results more than expected: OO-Harness lifted AutomationBench from 61.6% to 77.4% with the same Gemini 3.5 Flash model.
A harness is the kitchen around the chef: the tools, rules and step order the model works within. In OO-Harness that means specialized subclasses, lessons drawn from earlier runs and routing; Workspace-Bench rose from 25.5% to 39.5%. Agent S4 builds its own tools from past trajectories without success labels: an open 27B model reached 21.3% on OSWorld V2, 3.8 times more than with hand-built interfaces.
What it means: for builders. Everyone compares models — the harness is what to measure. Before paying for a pricier model, check what rebuilding the tools around your current one gives you.
Sources: OO-Harness · Agent S4 · automation templates
EAGLE-4: 3.6x faster answers without changing the model
EAGLE-4, a speculative decoding stack, speeds up Qwen3.8-27B by 3.59x over plain decoding; rivals DFlash 2 and DSpark reach 2.80x and 2.57x.
Speculative decoding is when a small draft model guesses several words ahead and the large model only verifies them, so the answer streams faster. On four NVIDIA B300s at single-request concurrency, EAGLE-4 reached 3.42x in SGLang, 2.83x in vLLM and 3.09x in TokenSpeed. The authors report smaller gains at higher concurrency. The EAGLE-4 draft model is about 3 GB larger than DFlash 2's.
What it means: for builders. A chatbot with modest traffic answers about three times faster on the same hardware. If your VRAM is already full, the extra 3 GB may not fit.
Sources: r/LocalLLaMA · EAGLE-4
Cohere Rerank 5: document search with up to 41% fewer tokens
Cohere launched Rerank 5 in Pro and Fast tiers; its Context Focus mode returns scored passages instead of whole documents and, the company says, cuts token use by up to 41% without losing accuracy.
A reranker is a model that picks the passages most relevant to a question before the main model reads them. On the same day NVIDIA's Nemotron 3.5 Parse, a document-parsing model under 1B parameters, took first place on ParseBench.
What it means: for builders. A bot that answers from a company's documents pays mostly for what it reads. Feeding passages instead of whole files trims that bill by close to 40%, if the claimed numbers hold on your documents.
Sources: Cohere · availability · ParseBench
Numbers and facts
Our own summary: what AI hardware costs as of October 21, 2026.
| Item | Price or requirement | Source |
|---|---|---|
| Recursive Flint, local | about 24 GB of memory | LM Studio |
| NVIDIA RTX PRO 5500 | about $11,400 per card | r/LocalLLaMA |
| NVIDIA RTX 6000 Pro | $16,000 | r/LocalLLaMA |
| HBM memory in 2027 | +150–200% in price | GSMArena |
- 41.7% for Claude Sonnet 5.5 and GPT-6 Astra on the revised MLCR-AA medical benchmark; no model exceeds 42% when completeness and accuracy are required together (Artificial Analysis). Claude's answers run 4–6 times longer than OpenAI's (comparison).
- 5–10% of requested volumes is what Nvidia may ship to Chinese buyers: per a cited source, it can make no more than 3M RTX PRO 5500 cards in 2027 against orders above 6M (r/LocalLLaMA).
- 1.5M versus 60K input tokens per second per accelerator — DeepInfer prefill throughput with and without cache hits at a 96% hit rate (ZhihuFrontier).
- 770 tokens per second — claimed decode speed for Muse Spark Open on TPU via SGLang's plugin for Google's open-source TorchTPU (Google, SGLang).
- 19 nodes instead of 16 — HGX B200 servers Lambda ran within the same power budget using DSX MaxLPS (Lambda).
- 6.5x fewer training tokens — what JOLT from Perplexity and NVIDIA needs to match GRPO on MATH (Aravind Srinivas).
Different views: is a used RTX 3090 worth buying for local models after the "unlock"?
A post on X claimed a "gpu-unlock" kernel module lifts RTX 3090 BF16 throughput from 82 to 155 TFLOPS; on real workloads, thread participants measured roughly a 10–12% gain in prompt processing.
- For. If the claimed numbers hold, an old 24 GB card gets noticeably faster at training and long-prompt processing (r/LocalLLaMA).
- Neutral. BF16 math is only part of a model's response time, the rest is bound by memory; it is also unclear whether the mod survives driver and CUDA updates (r/LocalLLaMA).
- Against. The top refutation in the earlier thread: no practical speedups on real workloads have been shown, and commenters call predictions that a used 3090 will cost more than a 5090 delusional (refutation).
Tools and techniques
- Ask an agent to check your projects for PHP2Shell in one sentence. Ben Tossell of Ben's Bites told Codex: "check if any of my work uses PHP or Railway, assess any risks and address them" (Ben's Bites). For websites, OpenAI released a dedicated checking skill (OpenAI). What you get: a list of exposed projects and an update plan without visiting each site by hand.
- Check your Claude API code before upgrading SDKs. API version
2026-10-21removestemperature,top_pandtop_kfrom Messages; new major SDKs default to it, while2023-06-01remains supported (ClaudeDevs, SDK). What you get: a bot you delivered to a client keeps working after a routine dependency update. - Build motion graphics from a scene described in code. psychopomp turns a scene described in code into a motion-graphics video (Ben's Bites). What you get: intros and infographics for client videos without hand animation in an editor.
In brief
- Claude Duet: Anthropic opened a waitlist for a proactive assistant powered by Opus 5.5 — initial access goes to Pro and Max users in the U.S.; purchases run through Stripe's Link wallet (Mike Krieger, access, Stripe).
- Linux kernel: Linus Torvalds' commit 14c8977 removed the requirement to tag AI-assisted code with an "Assisted-by" line (r/singularity).
- Waymo: 0.01 serious crashes per million miles versus a 0.21 human benchmark over 271.3M rider-only miles; the company plans to grow to 20,000 cars by the end of 2027 (r/singularity, data).
- Railway: after a security incident, customers could not update their services for 17 hours (Railway, Theo).
- GitLab: a CVSS 10 flaw allows unauthenticated code execution on self-managed servers; patches are out (report).
- GPT-Rosalind: thousands of OpenAI agents linked data on millions of mouse-brain cells with the literature in 32 minutes and proposed hypotheses for lab testing (OpenAI).
- Mirendil: the company says one researcher built its base model in 3.5 months for under $10M in compute (Behnam Neyshabur).
- SuperMimic: training a humanoid on 129,514 motions took 3 hours on one GPU versus 7 days on 128 in a prior setup (results).
- Ornith-1.5-122B: an open 122B reasoning and coding model with a 262K-token context window (Hugging Face).
- Kill My SaaS: Latent Space asked builders to replace a conference speaker-management tool quoted at $43,000 a year (Latent Space).
- Anthropic: experimental physicist and former Harvard science dean Christopher Stubbs joined the Long-Term Benefit Trust (Anthropic).