DeepSeek open-sources DeepInfer SOTA inference system with 80% marginsAI Uncovers Critical RCE in PHP, Drawing 432 Points on Hacker NewsPHP 8.x Emergency Release Patches Two RCE Flaws With Active ExploitsOpenAI Models Land on Google Cloud, Codex Workflows Head to Gemini Model GardenGitHub Moves 99.99999% of Repo Copies to Azure, Scales Reads via Object StorageChatGPT Ads Expand to 26 More Countries as Advertisers Top 100,000OpenAI Uses Thousands of AI Agents to Find New Leads in Biological DataVercel Routing Middleware Now Supports Python for FastAPI and FlaskOpenAI Launches Patch the Planet to Coordinate Open Source Vulnerability ResponseOpenAI Sets Consistent Safeguard Standards for Distribution PartnersSPEM Gives LLM Agents Structure-Aware Procedural Memory for Skill RetrievalFactorization-Guided Training Boosts Diffusion-Drafted Speculative DecodingNew Web Agent RL Model Factors Request Budgets and Failure Risk Into DecisionsminiTE Diagnoses the Execution Gap in Native NVFP4 Reinforcement LearningNavalia Trains Cowork Agents via Verifiable Task Synthesis for Long-Horizon Finance WorkYour AI Agent Fixed the Bug. What Else Did It Change?Tenex on Building AI-Native SDLCs for the Fortune 2000DataPraxis Generates Analytics Tasks via Verified Workspace EvolutionSoutheast Asia Digital Economy to Hit $368B in 2026 on AI AdoptionRust off Rails: An Opinionated Web Stack for the AI EraDeepSeek open-sources DeepInfer SOTA inference system with 80% margins

php2shell.com reports that AI uncovered a critical remote code execution vulnerability in PHP. The Hacker News thread hit 432 points and 172 comments, the hottest item in this batch, with discussion centering on reliability, false positive rates, and how such tools change security research workflows. Given PHP’s ubiquity, a confirmed RCE affects a large swath of web services.

PHP has shipped a security release across the entire 8.x line fixing two remote code execution holes. Simon Willison warns that exploits have been circulating since last night, making the upgrade urgent for anyone running PHP. RCE flaws allow attackers to execute arbitrary commands on a server, putting them at the top of the risk scale. Teams on PHP 8.x should prioritize patching and check logs for exploitation attempts.

OpenAI and Google Cloud are bringing frontier models and Codex workflows into Gemini’s Model Garden, available through Google Cloud Marketplace. Enterprises already on GCP can now call OpenAI models within their existing cloud billing and permission structure instead of provisioning a separate channel. For multi-cloud teams, the procurement and compliance path just got one layer shorter.

GitHub has moved a copy of 99.99999% of its repositories to Azure. The remainder will follow via per-reference quorums, a mechanism for reaching consistency across replicas. Object storage lets reads scale independently of writes, which matters as agents access Git repositories at much higher volume. For developers relying on GitHub, this bears on stability when automated agents pull code frequently.

OpenAI is expanding ChatGPT Ads to 26 additional countries, with more than 100,000 advertisers having already used the platform, ranging from local businesses to global brands. Ads appear as people explore, compare and decide what to buy inside ChatGPT. The expansion gives advertisers in more markets access to the conversational interface and marks a broader geographic rollout of OpenAI’s ad business.

OpenAI published a post on scaling AI research for complex biological data, describing the use of thousands of AI agents to uncover new leads. The item drew 126 points and 81 comments on Hacker News. The approach runs many agents in parallel over biological datasets to widen the search for candidate findings, which research teams could use to shortlist directions for experimental follow-up.

Vercel now lets developers write routing middleware in Python for FastAPI, Flask, Django and other Python frameworks. The middleware runs as an ASGI or WSGI app before requests reach the application, and can rewrite, redirect or directly answer them. Setup requires pointing the proxy entrypoint in vercel.toml at your proxy app. For Python teams, this means auth checks, A/B tests and URL rewrites can live at the edge without leaving the Python stack.

OpenAI announced Patch the Planet, connecting security researchers, open source maintainers, and incident responders to address critical vulnerabilities in open source software. It is positioned as a response coordination mechanism rather than a scanning tool, targeting the disclosure-and-fix handoff after agents surface a vulnerability. Whether it shortens patch windows depends on how many parties sign on.

OpenAI published how it works with distribution partners to maintain consistent safeguards, support responsible access, and clarify expectations in its Usage Policies. The upshot: models accessed through partner channels are held to the same usage rules as direct access. This matters for developers calling OpenAI models via cloud providers or regional resellers, where the channel changes but the policy does not.

LLM agents increasingly rely on reusable skills, but scaling skill libraries makes efficient and accurate skill use hard: full skill loading incurs high token and runtime overhead, while flat semantic retrieval treats skills as isolated items. SPEM proposes structure-aware procedural memory that exploits relationships among skills for retrieval and reuse. The approach targets efficiency as skill libraries grow and applies to agent systems that combine many tools and skills.

A new arXiv paper tackles a tradeoff in diffusion-drafted speculative decoding: diffusion drafters parallelize proposal generation further, but scaling proposal capacity or mean accepted tokens (MAT) introduces performance compromises. The authors propose factorization-guided training and inference to address it. Speculative decoding is a mainstream path for LLM inference acceleration, so such improvements translate directly into output throughput per unit of compute.

A new arXiv paper addresses web agents that operate under request budgets, latency, anti-crawling restrictions and operational failure risk. The authors argue that strategies optimizing only task success rates often become unusable in practice, and propose an agentic reinforcement learning decision model that accounts for multiple costs and failure risk. The work offers a framework for trading off success rate against request volume and failure penalties in real-world automated web tasks.

Native NVFP4 promises to accelerate reinforcement learning for large language models, but stable learning remains difficult when training and sampling run in separate engines. The paper identifies matching model weights and numerical formats as a key issue and introduces miniTE to diagnose and bridge this execution gap. The work targets numerical inconsistency in low-precision RL training and is directly relevant to teams running RL with decoupled training and inference stacks.

A new arXiv paper introduces Navalia, which pushes LLM agents from conversational assistants toward cowork agents capable of autonomous planning, tool use, and complex task execution. The training pipeline combines verifiable task synthesis with long-horizon post-training, validated on financial analysis tasks requiring cross-document evidence integration. If reproducible, the enterprise agent bottleneck shifts from capability to verification.

Trail of Bits examines the audit problem that follows an AI agent’s bug-fix patch: the agent fixes the target bug, but the same commit often carries undeclared changes. The post outlines how to locate these incidental modifications, focusing on diff review and change-scope constraints. The Hacker News thread drew 45 points and 6 comments, but the problem is real for any team wiring agents into CI.

Latent Space’s 44-minute episode features Alex Lieberman and CJ Hess on how Tenex builds AI-native software development lifecycles for Fortune 2000 companies. Key points: paying for outcomes rather than seats, building with agents, and the last mile of enterprise AI adoption being process change. It serves as a pricing and implementation reference from a frontline delivery shop.

The arXiv paper DataPraxis proposes scaling analytics tasks through verified workspace evolution. General-purpose agents are increasingly expected to do professional analytics work, which demands sustained reasoning, iterative investigation and reliable evidence—but training these capabilities requires diverse, challenging tasks that are in short supply. The method generates tasks by evolving workspaces and verifying outcomes. If it holds up, such data pipelines could give analytics agents a steadier supply of training tasks.

Southeast Asia’s digital economy is projected to reach $368 billion in 2026 and $1 trillion by 2035, according to Google AI Blog, which cites widespread AI adoption as the main driver. The forecast spans major digital sectors including e-commerce, ride-hailing and payments. For startups and cross-border businesses in the region, the growth opportunity concentrates in markets where AI penetration is rising fastest.

rustoffrails.org lays out an opinionated case for replacing Rails-style full-stack development with a Rust-based stack positioned for the AI era. The Hacker News thread drew 67 points and 74 comments, with discussion centering on Rust ecosystem maturity and AI toolchain integration. For teams weighing their options, it reads as a comparison list rather than a runnable migration path.