Ace Pace

haha, so apparently OpenAI are about to start training on your Daybreak Blue sessions, with no way to opt out. Literally stealing people's private work, as they do it, is cartoonishly evil. It also will presumably kill Daybreak usage by security researchers. Or at least, it should. The thing OAI have had to swear they are not doing to math researchers, they are now explicitly about to start doing to security researchers. Yet another reminder of the importance of open models.

Interesting to see the contrast between the obsession over single cycles many years ago, to patches like this today where with 4 lines of changes they increased throughput by 36gb/s: git.kernel.org/pub/scm/linux…

Last week, Tenzai’s AI hacker successfully exploited PHP2Shell across multiple PHP applications in our labs. Within days of disclosure, we had a working exploit integrated into our agent and demonstrated remote code execution against a variety of test targets. Credit to Calif whose research using GPT-5.6 Sol helped uncover the vulnerability, and the PHP maintainers for their work investigating and addressing these flaws. PHP2Shell illustrates how quickly exploitability can change. What matters is knowing which vulnerabilities can be exploited in your environment today and continuously validating that assessment as AI capabilities advance. “ We’ll fix it later” depends on assumptions about how much time, skill, and money an attacker needs. AI is making those assumptions obsolete, fast. That applies to the open-source components we all depend on. It also applies to proprietary applications and code nobody has reviewed in years. Security debt that once seemed manageable can become exploitable much sooner than expected. Looking at a vulnerability that could haunt the internet for a decade, despair is understandable. But, it isn’t useful. AI gives defenders ways to move faster, too: investigate unfamiliar code, discover vulnerabilities, develop patches, and test whether fixes actually work. Putting that capability to work takes people, funding, and a commitment to act on the results. At Tenzai, we’re helping security teams find exploitable weaknesses in their applications and validate remediation continuously. Our PHP2Shell results show how quickly a newly disclosed vulnerability can become a working test of real exposure. Expect more vulnerabilities like this. Use AI to find them earlier, prioritize based on demonstrated impact, and verify the fixes. Don’t despair. Take the initiative.

Last week, Tenzai’s AI hacker successfully exploited PHP2Shell across multiple PHP applications in our labs. Within days of disclosure, we had a working exploit integrated into our agent and demonstrated remote code execution against a variety of test targets. Credit to Calif whose research using GPT-5.6 Sol helped uncover the vulnerability, and the PHP maintainers for their work investigating and addressing these flaws. PHP2Shell illustrates how quickly exploitability can change. What matters is knowing which vulnerabilities can be exploited in your environment today and continuously validating that assessment as AI capabilities advance. “ We’ll fix it later” depends on assumptions about how much time, skill, and money an attacker needs. AI is making those assumptions obsolete, fast. That applies to the open-source components we all depend on. It also applies to proprietary applications and code nobody has reviewed in years. Security debt that once seemed manageable can become exploitable much sooner than expected. Looking at a vulnerability that could haunt the internet for a decade, despair is understandable. But, it isn’t useful. AI gives defenders ways to move faster, too: investigate unfamiliar code, discover vulnerabilities, develop patches, and test whether fixes actually work. Putting that capability to work takes people, funding, and a commitment to act on the results. At Tenzai, we’re helping security teams find exploitable weaknesses in their applications and validate remediation continuously. Our PHP2Shell results show how quickly a newly disclosed vulnerability can become a working test of real exposure. Expect more vulnerabilities like this. Use AI to find them earlier, prioritize based on demonstrated impact, and verify the fixes. Don’t despair. Take the initiative.

Anthropic has filed an S-1 registration statement with the SEC related to its proposed IPO. Read more: anthropic.com/news/s1-sec Legal disclaimer: A registration statement relating to these securities has been filed with the SEC but has not yet become effective. These securities may not be sold, nor may offers to buy be accepted, prior to the time the registration statement becomes effective. This post does not constitute an offer to sell or the solicitation of an offer to buy these securities, nor shall there be any sale of these securities in any state or jurisdiction in which such offer, solicitation or sale would be unlawful prior to registration or qualification under the securities laws of any such state or jurisdiction.

Boom! 🎆 Runs stable in our eval env! @Tenzai_Labs 🤖

Update: Our PHP exploit is now production-grade. * stock php.ini-production, display_errors=off, normal memory_limit, multi-worker, ASLR, under load * ARM64 + x86-64 targets * MediaWiki, WordPress, phpBB, Laravel * Apache/mod_php and nginx/php-fpm -> root xitter.gq/dguido/status/21131291…