Black October: PHP Crisis, OpenAI's Patch Gap & Meta's AI App

(00:00:00) Black October: PHP Crisis, OpenAI's Patch Gap & Meta's AI App

(00:00:37) METR and Redwood Unverified Findings

(00:01:24) Black October PHP Vulnerability Crisis

(00:02:16) AAIF Open Agent Standards Launch

(00:03:08) Meta AI App Goes Standalone

(00:03:41) Defense Procurement Surge

(00:04:08) Key Watchpoints Ahead

A convergence of AI-driven security crises and major industry moves defines today's briefing. OpenAI's adversarial red-team review uncovered a critical flaw in the Brotli compression library, resuming a month-long halt on frontier model training — but independent evaluators at METR and Redwood flagged exploits that remain unverified as patched. That gap between a company's assurance and independent confirmation is the story inside the story.

The wider alarm is structural. AI tools identified long-hidden vulnerabilities in PHP, which underpins roughly 70% of the web. Within hours of disclosure, exploitation attempts scaled from thousands to millions. The NSA issued an emergency patch advisory. Security professionals are calling it Black October. Anthropic's CISO has warned of AI-accelerated discovery outpacing patch capacity for months ahead, and Cloudflare's CEO describes the next two years as an incredibly fraught period for cybersecurity.

Meanwhile, the Linux Foundation's Agentic AI Foundation unveiled four open agent standards at AGNTCon — including Open Responses, which adopted a technical charter with immutable spec snapshots designed to give enterprises real contractual leverage over AI infrastructure providers. The catch: no listed provider currently passes the full acceptance test suite.

Meta launched its standalone AI app at LlamaCon, powered by Llama 4, with voice-first design and integration across Ray-Ban glasses and Messenger. And on the defense side, Lockheed, Raytheon, and L3Harris secured contracts totalling over a billion dollars — signalling sustained Pentagon AI and defense spending well into the next decade.

Three watchpoints close the episode: patch verification, PHP response speed, and whether Open Responses gains real compliance.

This episode includes AI-generated content.