In partnership with
In Todayโs Issue:
๐จ The night hacking hit machine speed
๐งฎ A mathematician hands AI 1,000 open problems
๐ค Claude Duet arrives, OpenAI moves onto Google Cloud
๐งฌ Turning an 80-year-old's blood into young brain cells
โจ And more AI goodnessโฆ
โก The Signal
For one night, the internet's security ran at machine speed, and AI was working on both sides.
Within hours of Wednesday's disclosure of PHP2Shell, two AI-discovered flaws in the software behind an estimated 70% of websites, Cloudflare was counting millions of exploit attempts and governments from Tokyo to Helsinki were taking services offline. The same day, Microsoft described a China-aligned group whose AI agents went after more than 2,250 corporate cloud accounts. That is the turning point: finding and exploiting old bugs no longer takes a team months. Defenders still got there first: the PHP holes were found by researchers who used a two-month head start to have patches and new firewall protections ready on disclosure day.
All the best,
Kim Isenberg
(SCMP / Weibo)
๐งฎ China's Sun Zhiwei Hands AI 1,000 Unsolved Problems
Nanjing University number theorist Sun Zhiwei has compiled 1,000 unsolved conjectures of his own in a 400-page collection, a long list of open targets for human and AI mathematicians alike. Sun, 61, treats AI as "a highly knowledgeable, diligent and intelligent graduate student" and even cuts off its internet search so it cannot learn that a problem is still open and refuse to try. He argues that progress depends on people who ask new questions: "If a discipline has no conjectures, people no longer know what to do and the field approaches a standstill."
๐ tl;dr: A leading Chinese mathematician has published 1,000 of his own open problems, giving researchers and AI systems a concrete list of real, unsolved targets.
(Anthropic)
๐ค Anthropic Launches Claude Duet, an Agent That Comes to You
Anthropic opened a research preview of Claude Duet, a standalone app in which Claude works as a proactive agent instead of waiting for prompts. It watches your connected apps, sends a daily briefing and handles tasks from scheduling meetings to building financial forecasts, with 6,000+ connectors and plugins and payments via Stripe's Link and Shop Pay. Duet runs on Opus 5.5, asks before sensitive actions and is waitlisted for Pro and Max subscribers in the US; Anthropic admits it "can still misjudge what's urgent."
๐ tl;dr: Claude Duet is Anthropic's always-on assistant: it tells you what needs your attention and keeps working on tasks while you're away.
(OpenAI)
โ๏ธ OpenAI's Models Are Coming to Google Cloud
OpenAI and Google Cloud are bringing OpenAI's frontier models and its Codex coding agent to Model Garden, the catalog where Google Cloud customers pick AI models. Companies will buy through the Google Cloud Marketplace and can count the spend against their existing Google Cloud commitments, and OpenAI models are also coming to Google's Antigravity coding app and Gemini Agent. General availability is planned "in the coming weeks," and OpenAI stresses that Microsoft "remains OpenAI's primary cloud partner."
๐ tl;dr: Google's cloud customers will soon be able to run OpenAI's models next to Gemini, turning two fierce rivals into business partners.
Webinar: Running Agents in Customer Work
Agents used to answer questions. Now they're doing the work: issuing refunds, updating accounts, closing tickets end to end. Running Agents in Customer Work is four 30-minute conversations with the people building, buying, and living with agentic AI in customer operations, no pitch, no product walkthrough.
Four Tuesdays, Oct. 13 through Nov. 3, 10 a.m. PT. Register free, one sign-up covers all four.
๐ฌ Watch This
A week after Gemini 4 Argon's wider release, Google CEO Sundar Pichai sits down with Alex Heath on the Sources podcast. He explains why even Google has to ration a model this large by compute, why cyber researchers got early access before launch (Argon is one of the models Wiz used to find PHP2Shell), and why he sees 2027 as a "golden age" for AI-driven productivity, including models that help improve model development itself. Pressed on Google turning free cash flow negative this summer, he points to research signals that Gemini 5.0 will be much better than Argon and to signed long-term contracts: "It's not just hope."
"It was a long day and a long night, I know for all the IT and security folks ... I've not seen anything like this in a long, long time."
โ Satya Nadella, CEO of Microsoft, at a company event in Cologne on Thursday, via Reuters
He was talking about the PHP2Shell patch scramble. His company's threat researchers published the Storm-0940 report from today's lead story the same day.
DeepSeek is reportedly helping Huawei design its next AI chips, with Huawei engineers working inside DeepSeek's offices, according to The Information. That would put China's top open-model lab in the chip-design loop, a step toward frontier AI without Nvidia, just as the WSJ reports a fresh $15 billion raise ahead of a possible IPO.
The Night Hacking Hit Machine Speed
The Takeaway
๐ PHP2Shell: two critical flaws in PHP, the language behind an estimated 70% of websites, found by Wiz researchers with AI models including Gemini 4 Argon and GPT-5.6 Sol.
๐ Governments and companies from Tokyo to Helsinki took services offline to patch while Cloudflare counted millions of exploit attempts.
๐ Microsoft says the China-aligned group Storm-0940 used ARTEX, an open-source AI agent framework, against ConnectWise customers' cloud accounts.
๐ Running a website? Update PHP (8.5.12, 8.4.27, 8.3.36 or 8.2.35) and Node.js now; Railway users should rotate their stored keys.
Between Wednesday and Thursday morning, the internet had to defend itself against AI-found flaws and AI-run attacks at once. PHP's developers shipped emergency fixes for PHP2Shell, two flaws that had sat in the language for about a decade and let attackers take over a web server without logging in. Wiz researchers found them with AI models including Google's Gemini 4 Argon and OpenAI's GPT-5.6 Sol, and say AI let a single researcher do in a week what once took a team months. Details leaked early: Cloudflare saw thousands of exploit attempts before the announcement and "millions now" by early Thursday, while Nomura, ANA and government agencies in Japan and Finland suspended online services as a precaution.
The UK's National Cyber Security Centre urges immediate action on the PHP flaws. (REUTERS/Toby Melville)
The attackers have AI too. The same day, Microsoft assessed that a China-state-aligned group it tracks as Storm-0940 used ARTEX, an open-source framework of AI agents, to hijack the cloud backup app of IT provider ConnectWise and turn its access against customers' Microsoft 365 accounts. Its sign-in attempts reached more than 2,250 customer tenants, and at some victims it held privileged access less than three hours after first targeting them. Hosting platform Railway disclosed a breach of stored customer secrets it ties to a series of attacks on platform companies, and Node.js patched a high-severity flaw. Even some eMudhra security certificates turned out to rest on a private key that was, in Cloudflare CEO Matthew Prince's words, "Literally the number 4."
Wiz's proof of concept takes over a WordPress server without a password in about a minute. (Wiz Research)
Defenders found the PHP holes first, and they used AI to do it. Wiz reported them to PHP in August, and OpenAI says it coordinated maintainers and security firms on fixes, an example of what it calls the "Defender's Window." Cloudflare had protective rules live about nine hours before disclosure. Its CTO Dane Knecht expects more: "Models will keep finding bugs like this in software everyone runs." The same models that make attacks cheaper found these decade-old flaws first and bought defenders two months to prepare.
Why it matters: The gap between a flaw becoming known and attackers exploiting it has shrunk to hours, and AI now works on both sides of that race. How fast software gets patched, and who has the best models hunting for bugs first, will increasingly decide how safe the everyday web is.
Sources:
๐ https://www.microsoft.com/en-us/security/blog/2026/10/21/storm-0940-uses-artex-agentic-ai-connectwise-supply-chain-compromise/
๐ https://blog.railway.com/p/security-disclosure-wednesday-october-21st
๐ https://vercel.com/kb/bulletin/node-js-security-advisory
๐ https://www.wiz.io/blog/php2shell-php-rce
๐ https://www.reuters.com/world/asia-pacific/cloudflare-sees-millions-exploit-attempts-after-php-disclosure-2026-10-22/
๐ https://blog.cloudflare.com/php-vulnerabilities-waf-protection/
๐ https://x.com/OpenAI/status/2112907856018309586
Sam Altman's Favorite Productivity Book Isn't About AI
It's Zero to One. Shortform turns books like it, into guides with the key ideas and how to use them. Get the ideas behind the breakthroughs in about 15 minutes.
(Microsoft Threat Intelligence)
The chart: Microsoft's snapshot of Storm-0940's campaign with ARTEX, the open-source AI agent framework from today's lead story. In a password-spray phase from October 10 to 14 it logged 151,000+ failed sign-ins against 327 accounts at eight organizations, peaking at 2,900 attempts a minute. With four stolen app credentials it made 200+ sign-ins in under four minutes and reached 2,250+ tenants.
The lesson: Password spraying and hijacking trusted app logins are years-old tricks. ARTEX changes who runs them: agents work around the clock and try many paths at once, which turns a slow, noisy campaign into one that outpaces most security teams. That is the attacker's side of today's lead story.
The caveat: Most attempts failed: nearly 98% of the spray ended in account lockouts, and Microsoft notes that a successful sign-in "does not necessarily indicate" that data was accessed. The ConnectWise link is Microsoft's assessment, not a confirmed attribution.
๐งฌ Bonn Scientists Make an 80-Year-Old's Cells 60 Years Younger
โก Bottom line
Bonn researchers turned blood cells from an 80-year-old into brain stem cells with a molecular age under 20.
๐ก Why it matters
The rejuvenation unfolds slowly over weeks, so scientists can watch it happen and test what speeds it up or slows it down.
๐ What it means
Age is the biggest risk factor for Alzheimer's; this lab model could help find substances that keep brain cells young.
A blood sample from an 80-year-old went into the lab, and brain stem cells with a molecular age under 20 came out. A team led by Oliver Brรผstle at the University Hospital of Bonn and the University of Bonn reports the result in the journal Aging Cell. Using a cocktail of transcription factors, proteins that decide which genes a cell reads, they converted red blood cell precursors directly into neural stem cells, the cells that neurons grow from.
Neurons grown from blood-derived neural stem cells. (Brรผstle Research Group / University of Bonn)
To measure age, the team read the cells' epigenetic clocks: chemical marks on DNA that accumulate as we get older without changing the genes themselves. Reprogramming wound those clocks back by roughly 60 years. And the effect is more than a number, Brรผstle says: "this epigenetic rejuvenation ensures that the cells actually behave like young cells."
The surprise is the pace. Earlier methods first turned cells into all-purpose pluripotent stem cells, and the rejuvenation happened quickly. Skipping that detour made it gradual, so the team could follow the clocks winding back for more than 100 days.
Neural stem cells made from the blood of a 101-year-old donor. (Brรผstle Research Group / University of Bonn)
That slowness is what makes the study useful. Because the clocks reset over weeks, "we can use this model to investigate which factors and active substances accelerate or slow down the rejuvenation process," Brรผstle says. Age is the biggest risk factor for Alzheimer's and other brain diseases, and a dish in which cells visibly grow younger gives researchers a way to test what keeps neurons young.