🌍 WanGP v18.81 — The One World Generator Build a world from text with Hy-Nomas or from an image with EVOKE, then explore it with your keyboard! Save your progress, record your journey and revisit familiar places—starting at 8 GB VRAM thanks to MMGP v4. 🤖 Deepy Prime your local Agent gets roughly 2× the context at the same VRAM, plus new abilities: 🔎 Search the web and find compatible LoRAs 🐍 Create graphics, animations and batch workflows with Python 🧊 Generate 3D assets and explorable worlds 🎬 Restore, upscale and outpaint videos through Media Flow Free to run locally. Your GPU has more places to take you. github.com/deepbeepmeep/WanG…

Still kicking ordinary balls this Halloween? Get ready for Screamball! 😱

The compass spinning. 😂

PHP exploit per @grok : **PHP (PHP: Hypertext Preprocessor) is a widely used open-source, general-purpose server-side scripting language especially suited for web development.** It was created by Rasmus Lerdorf in 1994 and has long been one of the most popular languages for building dynamic websites and applications. It powers a large share of the web—roughly 69–70% of websites whose server-side language can be detected (per W3Techs data around 2026), including major platforms like WordPress (itself used on a large portion of the web), Drupal, Joomla, Magento, MediaWiki, Laravel, and many others. PHP typically runs on web servers via setups such as PHP-FPM, Apache’s mod_php, php-cgi, FrankenPHP, or LiteSpeed.[](<php.net/>)[](<checkthisfact.com/factchecks…>)[](<webcode.tools/statistics/php…>) ### The current exploit: PHP2Shell (CVE-2026-109618 and CVE-2026-109619) This is the issue setting the internet “on fire” right now (as of October 21–22, 2026). It consists of **two critical vulnerabilities in the PHP core itself** (not in any specific application), both rated CVSS v4.0 9.2. They enable **unauthenticated remote code execution (RCE)** and, in some cases, memory disclosure (Heartbleed-style leaks of process memory that can contain secrets, tokens, keys, etc.). - **CVE-2026-109618**: RCE via out-of-memory (OOM) corruption. Out-of-memory handling can interrupt PHP while internal request data is only partially initialized; cleanup then treats invalid data as valid, leading to use-after-free and related issues. - **CVE-2026-109619**: RCE via stale global state. Request-owned internal state can survive after its backing memory is freed; a later request on the same worker can use that stale state. These bugs involve low-level memory management and error handling in the PHP engine (including multipart form handling and session upload-progress features, which are enabled by default). In the highest-risk cases (especially Apache with mod_php), an unauthenticated attacker can trigger the attack with a crafted HTTP request *before any application code runs*. Researchers (including teams from Calif, Wiz, and OpenAI) demonstrated unauthenticated RCE against default or near-default setups of WordPress, Drupal, Joomla, Magento, MediaWiki, Laravel, Symfony, phpMyAdmin, Nextcloud, Roundcube, WHMCS, and even simple “Hello World” apps. The issues affect PHP versions going back years (at least to 5.4 in relevant code paths); official patches cover supported branches.[](<research.jfrog.com/post/php2…>)[](<securityweek.com/php2shell-p…>)[](<sansec.io/research/php2shell>)[](<wired.com/story/this-is-not-…>)[](<php.net/>) **Patches were released on October 21, 2026** (accelerated after a leak of details on October 20 broke the embargo): PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. Minimal source backports were also provided for some older branches (7.4, 8.0, 8.1). PHP 8.1 and older are end-of-life from the PHP project’s perspective, so they rely on vendor/distribution backports or upgrades. There are partial mitigations (e.g., disabling `session.upload_progress.enabled`, adjusting memory limits, blocking multipart/form-data at the web server, or taking systems offline), but they are incomplete—**updating PHP is the only full fix**. Highest risk is on mod_php; FPM and other SAPIs are also affected.[](<securityweek.com/php2shell-p…>)[](<php.net/>)[](<sansec.io/research/php2shell>) The bugs were discovered/reported earlier (around August 2026) in a coordinated process involving AI-assisted analysis; the public leak forced an early release. Fake/prank PoCs also appeared amid the scramble. ### Current scope of attacks (as of late October 21 / early 22, 2026) - **Exploitation attempts are happening in the wild**, including before the patches landed. Cloudflare reported early attacks (~07:43 UTC on Oct 21). Hadrian reported seeing it “exploited in the wild at scale,” mostly abusing the session upload-progress path. WatchTowr observed attempts on honeypots (around the time of the patch release and after), Patchstack and others saw probing/exploitation activity, and Vega noted attempts using a public PoC. Amazon Threat Intelligence recorded at least one attempt as early as October 17 (pre-disclosure) on its MadPot honeypots. Some scanning/tooling has been observed with distinctive markers.[](<securityweek.com/php2shell-p…>)[](<sansec.io/research/php2shell>)[](<helpnetsecurity.com/2026/10/…>)[](<blackoutmap.net/blog/php2she…>) - **Confirmed successful compromises** of production systems have not been widely publicized yet (as of the latest reports). Some sources (including early CISA-related notes and certain national agencies) had not observed successful exploitation or listed it in known-exploited catalogs at the time of initial statements. The situation is developing rapidly; mass exploitation was widely expected once reliable PoCs and write-ups circulated post-release. One estimate put potentially exposed hosts in the high hundreds of thousands to over a million range based on version banners, though this is not a precise vulnerability count. - **Precautionary response has been significant**: Multiple governments and organizations (e.g., Dutch DigiD/MijnOverheid and other services, various European government sites, Japanese platforms, Wikimedia in some contexts, and others) took sites offline or into maintenance as a precaution before or around the patch. Japan’s government and CERT-EU (among others) urged urgent action. Cloudflare deployed WAF rules early. In short, this is a high-impact, widely affecting issue in the PHP engine that underpins a huge portion of the web. Internet-facing PHP servers should be patched immediately (or mitigated/isolated if patching isn’t possible right away), workers restarted, and versions verified as actually running the fixed release. Monitor for related activity and consider rotating secrets if memory disclosure is a concern. Check official PHP advisories, your distribution/vendor, and security sources for the latest updates, as this is still an active situation.[](<securityweek.com/php2shell-p…>)[](<wired.com/story/this-is-not-…>)[](<blackoutmap.net/blog/php2she…>)

Introducing Rakazo, an open-source Grok Bot alternative! - Use any LLM (pi harness) - Use any sandbox provider. Or Docker - Web, desktop (Electron), and mobile (React Native) - Open source. Apache 2.0 license Built with Cursor and Grok 4.6. It's a nice model. Repo. Give it a star: ⭐ github.com/elie222/rakazo

“AI can build anything, so nobody needs apps anymore” Most people still don’t know how to use AI properly, don’t want to build their own software, and have no interest in replacing the apps they already use Even my 70+ year-old mother uses AI. She’s not about to start vibe-coding her own apps. X is a bubble Should I just buy a farm, open a clothing store, or start dropshipping? 😂 Apparently, building apps for a living is pointless now

AI may change the price of your Big Mac and groceries — what this means for shoppers | CNBC buff.ly/qWiReqt Supermarkets and fast food giants are increasingly using artificial intelligence to digitize their operations. Some have been accused of using so-called “dynamic pricing” to set rapid real-time changes in prices that could dramatically affect shoppers’ experiences.

To buy stuff, you can just take a picture of your credit card, drop it in the chat and Grok @Bot will scour the Internet for the best deal on the item you want and order it

Our SynthID technology lets you easily verify if an image, video, or audio file is AI-generated, and today we’re expanding access. Now anyone can go to synthid.com to check files for a SynthID watermark — whether they were generated by us or industry partners like @OpenAI, @nvidia, Kakao, and, coming soon, @Apple. To date, we’ve watermarked 180 billion images and videos and more than 240,000 years of audio content, regularly handling 1 million verification requests daily. This new portal joins our built-in verification features already live in Search, @GeminiApp, and @googlechrome.

Google < Perplexity

Super Intelligence

one news form today that's easy to miss is that we (OpenAI) again paused all big RL runs last Sunday because our newest model found a new loophole in our RL sandboxing that gave it live Internet access