I'm currently evaluating GLM and oh boy, lots of correctness issues on large contexts if you run it on vLLM (bugs in the engine itself). I wonder what their config is.
The average age of the explored models is ~1.5 years. They discuss PHP 8.3, which was released in 2023 and has not been actively supported since 2025. Agentic coding isn't used.
I'm not sure what the point is of publishing results on the mid-2025 state of the art in October 2026.
I ran 2 PoCs from GitHub today: one indeed expected Local File Inclusion (LFI) to already be present (so it's just LFI with extra steps), and the other one didn't work at all out of the box without some modifications (although I used the same Docker images and all). The second PoC did trigger a real stale write bug in the end, but it didn't demonstrate actual RCE; it just triggered a stale write. And then I wondered, is this the first time ever that the PHP runtime has had a memory corruption bug? I doubt it (I remember a few years ago we had random crashes in production under high load due to an opcache bug). And if it's not the first memory corruption bug in the PHP runtime, why is it being proclaimed the worst vulnerability in years?
There is an argument to be made that taking down such a sizable chunk of the Internet automatically qualifies it as a pretty severe vulnerability, even if no actual exploits were involved in causing it.
More seriously, though, I read it as bad because of the potential. All versions of PHP going back a full two decades were affected, all users of PHP are affected regardless of which features they use, and it’s still unclear if there’s an effective mitigation. So the blast radius if anyone does/did have a working exploit would have been enormous.
I'm in charge of my employer's ecommerce website. To me there's a critical difference in severity between a RCE vulnerability and being to takedown/crash a website.
We do need to eventually see the proof that this was so urgent. Because if it wasn't then this was effectively a massive DOS attack on society.
"9.2" is a big claim and a powerful justification for action, but with OpenAI involved my faith is very low that this isn't largely a publicity stunt. Especially given the age of the vulnerability.
You've got under 5 minutes to decide whether or not a widely reported critical security vulnerability actively being exploited in the while is severe enough to warrant taking down your site or not. The downside for taking down your site is approximately 0, and the upside is that you don't get shrekd
No security expert can or should work that fast. Its a completely reasonable thing to do given the hyperbolic reporting just in case it turns out to be true. Some websites being down for a few hours doesn't end the world
> The downside for taking down your site is approximately 0
> Some websites being down for a few hours doesn't end the world
Many governmental websites are still down and they say might stay down for days or weeks. Some are not directly related to PHP, but auth doesn't work due to firewall hardening or similar. There definitely is a non-zero downside.
Agreed. This is all lazy chair hindsight talk, maybe by those not affected by it. In the moment you act on the imperfect information you have available and you use the safe than sorry rule. And to demand perfect information is also a fallacy, it doesn’t exist until after the fact.
I hear you, but also I'm not so sure. I remember Log4j, heartbleed, etc. and they were just as serious, but I don't recall people just going dark immediately. Scripts to validate whether or not you had exposure were built, people ran them, and if you did have exposure you started checking to see whether or not it was exploited. This timeline for this seems wildly different to me.
Because it’s not the same type. There was no actual info until the patch dropped, with some people in the know , which made it dangerous to leave your site up. The stopgaps were wild guesses. The multi-upload mitigation wouldn’t have worked.
There was no check that could be trusted to be the check to mitigate it. So that left the scenario that we went through.
There wasn't any info on the exploits beyond hearsay and the claim that they're very serious, so the risk assessment, sober or not, boils down to "do I trust the PHP people when they claim this is very serious"
I mean Patch the Planet. This was the first I had heard of it, and I assumed from seeing the press releases from OAI working their way through journalism’s digestive tract that it was announced today - but perhaps it was previously announced.
If that is case, I’ll refine my statement to “Also happening today: OpenAI is doing a PR push on their software vulnerability initiative”, which I think suffices to convey the same meaning as the original.
All the people with LLM on their hands, looking for fame to post PoCs on GitHub, but without zero understanding whether it actually exploited the described vulnerability. Even that most cited blog post here was pure slop, and the exploit did not actually work.
It says 46 tok/sec for Qwen3.6-27b 4 bit on RTX5090, but I get 60-70 tok/sec on a small context like that (5 bit weights with 8 bit KV cache), although it does slow down to 40 tok/sec on large contexts. If I add ngram speculation, then it can increase to 100+ tok/sec on code.
There are many knobs to tweak to make it faster, which the site ignores.
Attacking a NATO country would mean total war for Russia. Currently there are no signs that Russia is ready for total war, or willing to have one. Russia has been fighting a war of attrition in Ukraine for 4 years, without a moving frontline, exactly because it wants to win by slow attrition.
Total war (all money going to the war, millions of mobilized workers, etc.) would result in an economic collapse, which Russia is trying to avoid. Aside from "inconveniences" like Yandex AI not working after a data center hit, Russia's everyday life is largely unaffected by the war (at least compared to Ukraine's) - exactly because it is avoiding total war.
If Russia were desperate enough to finally go all in and have full mobilization (millions of conscripts, all industry working around the clock building nothing but drones and missiles, etc.), why would it start by attacking random EU countries instead of Ukraine itself? So I think it's very unlikely that anything is going to happen to Europe other than sabotage here and there. Remember that Putin is a KGB agent, and they're more about targeted tactical operations than strategic chess play.
The whole "special military operation" thing was itself just a way to quickly coerce Zelensky into signing an agreement by threatening force, without total war, but it fell apart, so they had to go this war-of-attrition route
> Attacking a NATO country would mean total war for Russia.
Is that so? I wouldn't trust the USA to commit to its NATO responsibilities anymore. The rest of NATO, torn as it is, could just as well find all kinds of reasons why this particular attack isn't a "real" attack, just to avoid the confrontation.
I wouldn't bet on that scenario happening, but as Russia, I wouldn't dismiss it outright either.
Europe has 4 times the population of Russia. The only successful attacks in the past 20 years have been against politically divided countries, like Syria, Venezuela and Ukraine (civil war since 2014). Iran is united, and so is Europe.
Lavrov has indicated he knows Russia would lose a conventional war against Europe by saying that an attack by Europe would start a quick (i.e. nuclear) war.
I agree that the US would stay out, especially if it is nuclear.
Multiple European governments are about to flip right. I’m not convinced a La Pen administration would send French troops to protect the Baltics or even Poland.
Lavrov says all kinds of things. Whatever he utters serves a purpose and has no logical relation to truth.
Don’t underestimate the capability of the EU to gridlock itself with decision paralysis. If we were decisive actors, we would have long stopped tolerating the hybrid attacks Russia is deploying against us today. Europe is anything but united now! We’re still purchasing oil from Russia. We can’t even agree on acting against the shadow fleet, or sanctioning all oligarchs, or applying second order sanctions.
A drone loaded with explosives targeting a German airport? We were merely lucky that it had a technical defect, or it may have been a disaster of epic proportions. Do you recall what the reaction to that was? I thought so.
Until we manage to gain some kind of unified agency, you better hope Russia cannot handle the logistics yet.
How would a direct war with NATO on several fronts help Russia win in Ukraine? Russia isn't ready for it in the slightest. As I said, if they wanted to go all in (full mobilization instead of partial, martial law, converting all industry to military production, etc.), it would be more logical to focus first on that 1 country they want to defeat, rather than immediately triggering Article 5 and fighting 32 countries at once. It just doesn't make any sense, and judging by the Kremlin's decisions over the last 4 years, I don't think they're that stupid.
this goes both ways; they'd be gambling that NATO doesn't launch things into Russia. From the accounts I've seen they did strip down the rest of the border forts to supply Ukraine.
Also, most of NATO's existing resources are currently not doing much but standing around. You can question how useful NATO's 'pre-drone' material is, and how much hasn't already been sent to Ukraine, but it's not nothing.
>they'd be gambling that NATO doesn't launch things into Russia
The official discourse in Russia is that NATO is already helping Ukraine launch things into Russia. So there's no gamble; for them, it's already a fact. Except, currently, it's just a proxy war where Ukraine has to jump through hoops to get military aid and targets approved, and it can only fire from Ukraine's territory. With a direct confrontation, there's no doubt that far more would be launched into Russia.
> why would it start by attacking random EU countries instead of Ukraine itself?
Because if russian troops appear in EU countries, EU might be more willing to accept Ukraine losing larger territories in peace deals. That's why EU has to - once attacked - hit russia so strongly, that they will retreat on our conditions.
A very naive take from someone who clearly lives in a place where people have real choices, economic freedom, freedom of movement, and a government that protects them. "Just shut it down, bro" risks destroying your livelihood and leaving your family financially stranded, and yourself incarcerated or sent to the war zone. And it's not like Yandex develops weapons of mass destruction, you probably assume it's a collaboration even if Yandex simply hosts the Defense Ministry's websites. No sane parent will put their family at risk for this kind of stuff. "I'm going against the government for abstract ethical reasons" is something very few people/countries can afford.
And you can't shut it down anyway. The government will just nationalize it and keep it running. As long as you're the one in charge, you can at least throw a few hidden obstacles in the way, like dragging out legal processes.
No, a pretty informed take from someone who had family members that once upon a time made some very tough choices because they thought it was the right thing to do.
You can pretend at being ethical and moral as long as there is no price to pay, but when the time comes that it matters there will always be a price tag. Whether you are prepared to pay or not is what defines whether you are ethical or just pretending.
Company execs make decisions, employees make decisions, everybody carries a part.
AI models can multitask/use parallel subagents just fine; the issue is with harnesses that don't make it a priority via the default system prompt.
I run an LLM server with Qwen 3.6 in the office, and OpenCode, which the OP mentioned, usually defaults to sequential TODO lists, and it works fine with our little LLM server with 3-4 parallel users. But I noticed that once in a while the LLM got overloaded with requests in the queue, and you couldn't do anything for 20-30 minutes. My investigation led me to an employee who used QwenCode. I tried it myself then, and indeed, it immediately launched something like 6 parallel subagents, where OpenCode would have sequential TODOs with the same model by default.
So in the end, I had to detect QwenCode on the server side and serialize all its parallel requests into a single request queue, because it made life miserable for other OpenCode users :)
reply