php2shell-checker

PHP2Shell 資安風險? 我用 AI 一句話檢測網站! #ai #aitools #agent #codex #claudecode 最近有個 PHP 的資安風險叫 PHP2Shell,OpenAI 在 GitHub 上公開了一個檢測工具。 我直接叫 AI 幫我裝起來、掃我的網站,一句話就知道有沒有中招。 🔧 工具:github.com/openai/php2shell-checker(OpenAI 官方、免費開源) 安裝:跟 Codex 或 Claude Code 說「幫我安裝 skills from openai/php2shell-checker%E3%80%8D 檢測:再說「用 phpcheck-url 檢查我的網站」 ⚠️ 請只檢測你自己的網站。這是版本檢查工具,有風險的話升級 PHP 版本就能擋。 #資安 #PHP #vibecoding #claudecode #openai #AI工具

PHPの脆弱性を見つけるためのチェッカーツールっぽい 脆弱性対応の確認に使えそう yug1224 starred openai/php2shell-checker openai/php2shell-checker

PHP2Shell: cómo comprobar si tu PHP es vulnerable con la skill oficial de Codex ✅ yoDEV Tested OpenAI publicó php2shell-checker, una skill oficial de Codex que te dice si un sitio o un servidor usa una versión de PHP expuesta a PHP2Shell (CVE-2026-109618 y CVE-2026-109619) sin enviar ni una sola petición de exploit. Se instala en Codex con una instrucción, y el mismo script también funciona por su cuenta solo con Node.js. openai/php2shell-checker > ✅ yoDEV Tested · 21 de octubre de 2026 Ejecutamos php2shell-checker (commit 40a4746, Node.js 22.22 y PHP 8.3.6 de distribución) contra una instalación local de PHP, un servidor PHP local, un servidor parcheado simulado y un sitio público sin PHP. Los resultados que reportamos como nuestros salen de esa prueba. ¿Qué es la skill php2shell-checker de Codex? Es un pequeño script de Node.js más dos skills de Codex, que OpenAI publicó el 21 de octubre de 2026 junto con su anuncio de Patch the Planet sobre las vulnerabilidades de PHP. OpenAI lo presenta como un PHP version checker distribuido como Codex skill, pensado para que los operadores identifiquen versiones de PHP potencialmente vulnerables. El repositorio tiene licencia Apache-2.0 y no tiene dependencias: no hace falta npm install. Contiene tres piezas: - skills/phpcheck-url: comprueba la versión de PHP que anuncia una URL. Incluye el script real. - skills/phpcheck-server: solo instrucciones, sin script. Le indica a Codex cómo comprobar el PHP que realmente sirve un sitio cuando tienes acceso al servidor. - phpcheck.js en la raíz: un envoltorio de una línea sobre el script de la skill de URL, para que puedas ejecutarlo sin Codex. Lo más importante es lo que no hace: nunca prueba la vulnerabilidad. Lee cadenas de versión y las compara con una tabla de versiones límite. Al momento de publicar esta nota, el repositorio tenía 7 commits y ninguna release etiquetada (el script se identifica como 1.0.0), y OpenAI indica que no acepta contribuciones de código externas. Cambió dos veces el mismo día de su publicación, así que revisa el README antes de depender de cualquiera de los comandos de abajo. ¿Qué versión de PHP corrige PHP2Shell? PHP 8.5.12, 8.4.27, 8.3.36 y 8.2.35, publicadas el 21 de octubre de 2026. Son exactamente un parche por encima de los límites que trae el checker (8.5.11, 8.4.26, 8.3.35 y 8.2.34), así que un servidor con cualquiera de ellas devuelve OK. PHP 8.1 y anteriores no reciben una versión oficial. El equipo de seguridad de PHP publicó backports mínimos en código fuente para 7.4, 8.0 y 8.1, y las distribuciones Linux y los proveedores LTS recibieron los parches por adelantado. Explicamos las vulnerabilidades, las mitigaciones y las ramas sin soporte en nuestro artículo sobre PHP2Shell. ¿Cómo instalar la skill en Codex CLI? Pídeselo a Codex dentro de una sesión: $skill-installer install both skills from https://github.com/openai/php2shell-checker $skill-installer es la skill integrada de Codex para añadir skills. La documentación de Codex indica que también puede descargar skills de otros repositorios, no solo del catálogo oficial. Codex detecta automáticamente las skills recién instaladas; si alguna no aparece, reinicia Codex. Después, invoca la que corresponda a tu caso: $phpcheck-server check the PHP version serving my site $phpcheck-url check example.com Usa phpcheck-server cuando tienes acceso a la máquina, y phpcheck-url cuando solo tienes una dirección. ¿Cómo comprobar la versión de PHP de una web sin Codex? Clona el repositorio y ejecuta el script directamente. Node.js es el único requisito. git clone https://github.com/openai/php2shell-checker cd php2shell-checker node phpcheck.js "https://example.com" node phpcheck.js --local Flags útiles: --json para obtener una salida legible por máquina, --php PATH para apuntar --local a un binario concreto y --timeout SECONDS para hosts lentos. Un detalle con el que nos topamos: la CLI necesita una URL completa. Al pasarle un host:puerto sin esquema devolvió UNKNOWN: Invalid URL. La skill de URL lo resuelve por ti, porque sus instrucciones le piden a Codex que añada https:// a los nombres de host sin esquema. ¿Qué resultados obtuvimos al probarlo? La batería de tests (node --test phpcheck.test.js) pasó 39 de 39. Después lo ejecutamos contra cuatro objetivos: | Objetivo | Salida | Código de salida | | --------------------------------------------------- | ----------------------------------- | ---------------- | | --local, PHP 8.3.6 de distribución | VULNERABLE: PHP 8.3.6 | 1 | | Servidor local php -S con PHP 8.3.6 | VULNERABLE: PHP 8.3.6 | 1 | | Servidor local que envía X-Powered-By: PHP/8.3.36 | OK: PHP 8.3.36 | 0 | | github.com (sin cabecera de PHP) | UNKNOWN — "PHP version not found" | 3 | Con --json, la comprobación local devolvió: {"patch_status":"vulnerable","php_version":"8.3.6","reason":"PHP 8.3.6","exit_code":1} La primera fila es la más instructiva. Ese PHP 8.3.6 viene de los paquetes de la distribución, y las distribuciones suelen aplicar backports de seguridad sin cambiar el número de versión upstream. El checker no puede verlo. En nuestro caso tenía razón al alertar, porque la compilación es anterior a la corrección, pero con un paquete de distribución ya parcheado diría exactamente lo mismo. ¿Qué significan OK, VULNERABLE y UNKNOWN? Significan menos de lo que parece, y el README lo deja claro. - OK (código 0): la versión está por encima del límite de su rama. Es una comparación de versiones, no una verificación de la corrección. Las cabeceras se pueden reescribir, y un OK obtenido de una cabecera puesta a mano no vale nada: así es exactamente como conseguimos nuestra fila OK. - VULNERABLE (código 1): la versión es igual o inferior al límite. Si usas paquetes de distribución, confírmalo con el aviso de seguridad de tu proveedor antes de alarmarte. En 8.1 y anteriores seguirá diciendo VULNERABLE aunque apliques un backport en código fuente, porque la cadena de versión no cambia. - UNKNOWN (código 3): no encontró versión, la rama no está en la tabla o es una compilación previa a una versión estable. No significa que esté parcheado. Cualquier sitio que oculte X-Powered-By, una medida de hardening habitual, cae aquí. También las release candidates de PHP 8.6, porque la rama 8.6 no está en la tabla, aunque 8.6.0 RC4 ya incluye la corrección. Los argumentos inválidos devuelven el código 2. Los códigos 1 y 3 son resultados, no fallos de ejecución: útil si lo integras en CI o en un script de monitoreo. ¿Por qué no basta con revisar la URL? Porque solo ve lo que el servidor decide anunciar. El modo URL lee las cabeceras X-Powered-By y Server, envía una petición HEAD (y recurre a GET solo si recibe un 405 o un 501), no sigue redirecciones y no lee el cuerpo de la página. Eso lo convierte en una herramienta rápida de triaje para una lista de sitios, no en una prueba. La skill phpcheck-server existe para la comprobación más sólida: le indica a Codex que empiece con php -v, pero que confirme que la CLI coincide con la compilación de PHP-FPM o Apache que realmente sirve el sitio, y que compare la revisión completa del paquete con los avisos de PHP o del proveedor. Si no puede verificar la versión que sirve el sitio, la instrucción es reportar desconocido. Ambas skills incluyen la misma regla: no ejecutar pruebas de exploit. ¿Por qué importa que sea una skill de Codex? Es la primera vez que vemos a OpenAI publicar una skill oficial de Codex como repositorio independiente ligado a una respuesta de seguridad, en lugar de incluirla en su catálogo de skills o en su documentación. La skill es el mecanismo de distribución: una sola instrucción pone un checker revisado dentro del agente de cada usuario de Codex, con las salvaguardas ("no ejecutar pruebas de exploit") escritas en la propia skill. Para quien busque en inglés: son Codex skills que funcionan en Codex CLI, y el patrón de instalación con $skill-installer sirve igual para cualquier otro repositorio de skills. El mismo anuncio compromete suscripciones para mantenedores de código abierto a través de Codex for OSS. No pudimos confirmar cuándo se abrió ese programa, así que la noticia de hoy es la skill, no la suscripción. * ¿Y tú? ¿Cuántos servidores PHP tienes que revisar esta semana? Comenta abajo o, si este artículo te llegó por correo, responde directamente al email: tu respuesta se publica aquí. Relacionado: CVE-2026-109618 y CVE-2026-109619: qué versión de PHP necesitas y cuándo sale el parche

Trending Open-Source Github Projects: php-src, Impeccable, claude-mem, SPACE, DeepInfer & Filee #303 👉 AI Agents Studio : youtube.com "This video covers the top trending open-source GitHub projects this week. You will see tools for developer productivity, local-first apps, performance, and AI workflow improvement. Projects like claude-mem, SPACE, and editonny help coding agents remember past work, run code in a sandbox, and edit video through conversation. There are also tools for design, file conversion, and working across devices. If you like finding useful open-source tools, this update is for you." 👍 Like, share, and subscribe for more updates on AI advancements. Drop your thoughts and questions in the comments below! 📌 Get FREE AI Project Updates : manuagi.beehiiv.com 📌 Important AI Tools (affiliate) 🔗 AI Voice - try.elevenlabs.io 🔗Try Dzine AI FREE : dzine.ai 📌 Timestamps : 00:00 - Intro Part 00:53 - php-src : php/php-src 01:28 - knowledge-work-plugins : anthropics/knowledge-work-plugins 02:04 - ziwei-doushu : Renhuai123/ziwei-doushu 02:42 - rakazo : elie222/rakazo 03:18 - ai-engineering-from-scratch : rohitg00/ai-engineering-from-scratch 03:58 - impeccable : pbakaus/impeccable 04:37 - claude-mem : thedotmack/claude-mem 05:12 - php2shell-checker : openai/php2shell-checker 05:51 - free-my-tv : simbasjungles/free-my-tv 06:24 - SPACE : perplexityai/SPACE 07:01 - harp : dominikmartn/harp 07:37 - ascii-magic-art : kailashsr38/ascii-magic-art 08:18 - DeepInfer : deepseek-ai/DeepInfer 09:01 - editonny : soumatheusgomes/editonny 09:36 - fx0 : vercel-labs/fx0 10:10 - scrawl : kitlangton/scrawl 10:47 -TwinDesk : InukaAsith/TwinDesk 11:24 - git-ai : feder-cr/git-ai 11:59 - sill : Saffsanity/sill 12:35 - Filee : KnifeLemon/Filee 📈 Subscribe for more AI tutorials, tips, and industry insights. Don't forget to like, comment, and share with your tech-savvy friends! Tags: Trending Open-Source Github Projects, php-src, Impeccable, claude-mem, SPACE, DeepInfer & Filee, open source, open source github projects, trending github projects, github projects this week, developer tools, developer productivity, coding agents, ai agents, ai tools, ai workflow, workflow automation, local tools, self hosted, cli tools, claude code, codex, agent sandbox, llm inference, macos apps, mcp server, rust, swift, php, python, typescript Hashtags: #opensource #githubprojects #trendinggithub #developer #programming #devtools #productivity #aiagents #aitools #claudecode #codex #workflow #automation #selfhosted [ar] أبرز مشاريع GitHub مفتوحة المصدر الرائجة لهذا الأسبوع: php-src, Impeccable, claude-mem, SPACE, De... 👈 استوديو وكلاء الذكاء الاصطناعي: youtube.com "يتناول هذا الفيديو أبرز مشاريع GitHub مفتوحة المصدر الرائجة هذا الأسبوع. ستتعرفون على أدوات لزيادة إنتاجية المطورين، وتطوير تطبيقات محلية، وتحسين الأداء، وتطوير سير عمل الذكاء الاصطناعي. تساعد مشاريع مثل claude-mem وSPACE وeditonny وكلاء البرمجة على تذكر أعمالهم السابقة، وتشغيل التعليمات البرمجية في بيئة تجريبية، وتحرير الفيديو من خلال المحادثة. كما تتضمن أدوات للتصميم، وتحويل الملفات، والعمل على مختلف الأجهزة. إذا كنتم مهتمين باكتشاف أدوات مفتوحة المصدر مفيدة، فهذا التحديث مناسب لكم." 👍 اضغطوا إعجاب، وشاركوا، واشتركوا ليصلكم المزيد من التحديثات حول تطورات الذكاء الاصطناعي. شاركونا آراءكم واستفساراتكم في التعليقات أدناه! 📌 احصل على تحديثات مجانية لمشاريع الذكاء الاصطناعي: manuagi.beehiiv.com 📌 أدوات ذكاء اصطناعي مهمة (روابط تسويقية) 🔗 AI Voice - try.elevenlabs.io 🔗 جرّب Dzine AI مجانًا: dzine.ai 📌 الفواصل الزمنية: 00:00 - مقدمة 00:53 - php-src: php/php-src 01:28 - knowledge-work-plugins: anthropics/knowledge-work-plugins 02:04 - ziwei-doushu: Renhuai123/ziwei-doushu 02:42 - rakazo: elie222/rakazo 03:18 - ai-engineering-from-scratch : rohitg00/ai-engineering-from-scratch 03:58 - impeccable : pbakaus/impeccable 04:37 - claude-mem : thedotmack/claude-mem 05:12 - php2shell-checker : openai/php2shell-checker 05:51 - free-my-tv : simbasjungles/free-my-tv 06:24 - SPACE : perplexityai/SPACE 07:01 - harp : dominikmartn/harp 07:37 - ascii-magic-art : kailashsr38/ascii-magic-art 08:18 - DeepInfer : deepseek-ai/DeepInfer 09:01 - editonny : soumatheusgomes/editonny 09:36 - fx0 : vercel-labs/fx0 10:10 - scrawl : kitlangton/scrawl 10:47 - TwinDesk : InukaAsith/TwinDesk 11:24 - git-ai : feder-cr/git-ai 11:59 - sill : Saffsanity/sill 12:35 - Filee: KnifeLemon/Filee 📈 اشترك للحصول على المزيد من الدروس والنصائح والمعلومات حول الذكاء الاصطناعي. لا تنسَ الإعجاب والتعليق والمشاركة مع أصدقائك المهتمين بالتكنولوجيا! هاشتاغات شهيرة: مشاريع هاشتاغات شهيرة: مشاريع هاشتاغات شهيرة: أدوات ... [bn] ট্রেন্ডিং ওপেন-সোর্স গিটহাব প্রজেক্ট: php-src, Impeccable, claude-mem, SPACE, DeepInfer ও Filee #303 👉 এআই এজেন্টস স্টুডিও : youtube.com "এই ভিডিওতে এই সপ্তাহের সবচেয়ে জনপ্রিয় ওপেন-সোর্স গিটহাব প্রজেক্টগুলো তুলে ধরা হয়েছে। এখানে আপনি ডেভেলপারদের উৎপাদনশীলতা, লোকাল-ফার্স্ট অ্যাপ, পারফরম্যান্স এবং এআই ওয়ার্কফ্লো উন্নত করার জন্য বিভিন্ন টুল দেখতে পাবেন। claude-mem, SPACE, এবং editonny-এর মতো প্রজেক্টগুলো কোডিং এজেন্টদের তাদের আগের কাজ মনে রাখতে, স্যান্ডবক্সে কোড চালাতে এবং কথোপকথনের মাধ্যমে ভিডিও সম্পাদনা করতে সাহায্য করে। এছাড়াও ডিজাইন, ফাইল রূপান্তর এবং বিভিন্ন ডিভাইসে কাজ করার জন্য টুল রয়েছে। আপনি যদি দরকারি ওপেন-সোর্স টুল খুঁজে পেতে পছন্দ করেন, তবে এই আপডেটটি আপনার জন্যই।" 👍 এআই-এর অগ্রগতি সম্পর্কে আরও আপডেটের জন্য লাইক, শেয়ার এবং সাবস্ক্রাইব করুন। নিচে কমেন্টে আপনার মতামত এবং প্রশ্ন জানান! 📌 বিনামূল্যে এআই প্রজেক্টের আপডেট পান : manuagi.beehiiv.com 📌 গুরুত্বপূর্ণ এআই টুলস (অ্যাফিলিয়েট) 🔗 এআই ভয়েস - try.elevenlabs.io 🔗 বিনামূল্যে ডিজাইন এআই ব্যবহার করে দেখুন : dzine.ai 📌 টাইমস্ট্যাম্প : ০০:০০ - ভূমিকা পর্ব ০০:৫৩ - php-src : php/php-src ০১:২৮ - knowledge-work-plugins : anthropics/knowledge-work-plugins ০২:০৪ - ziwei-doushu : Renhuai123/ziwei-doushu ০২:৪২ - rakazo : elie222/rakazo ০৩:১৮ - ai-engineering-from-scratch : rohitg00/ai-engineering-from-scratch ০৩:৫৮ - impeccable : pbakaus/impeccable ০৪:৩৭ - claude-mem : thedotmack/claude-mem ০৫:১২ - php2shell-checker : openai/php2shell-checker ০৫:৫১ - free-my-tv : simbasjungles/free-my-tv ০৬:২৪ - SPACE : perplexityai/SPACE ০৭:০১ - harp : dominikmartn/harp ০৭:৩৭ - ascii-magic-art : kailashsr38/ascii-magic-art ০৮:১৮ - DeepInfer : deepseek-ai/DeepInfer ০৯:০১ - editonny : soumatheusgomes/editonny ০৯:৩৬ - fx0 : vercel-labs/fx0 ১০:১০ - scrawl : kitlangton/scrawl ১০:৪৭ - TwinDesk : InukaAsith/TwinDesk ১১:২৪ - git-ai : feder-cr/git-ai ১১:৫৯ - sill : Saffsanity/sill ১২:৩৫ - Filee : KnifeLemon/Filee 📈 আরও AI টিউটোরিয়াল, টিপস এবং ইন্ডাস্ট্রির তথ্যের জন্য সাবস্ক্রাইব করুন অন্তর্দৃষ্টি। লাইক, কমেন্ট এবং আপনার প্রযুক্তি-প্রেমী বন্ধুদের সাথে শেয়ার করতে ভুলবেন না! ট্যাগ: ট্রেন্ডিং ওপেন-সোর্স গিটহাব প্রজেক্ট, php-src, Impeccable, claude-mem, SPACE, DeepInfer & Filee, ওপেন সোর্স, ওপেন সোর্স গিটহাব প্রজেক্ট, ট্রেন্ডিং গিটহাব প্রজেক্ট, এই সপ্তাহের গিটহাব প্রজেক্ট, ডেভেলপার টুলস, ডেভেলপার প্রোডাক্টিভিটি, কোডিং এজেন্ট, এআই এজেন্ট, এআই টুলস, এআই ওয়ার্কফ্লো, ওয়ার্কফ্লো অটোমেশন, লোকাল টুলস, সেলফ হোস্টেড, সিএলআই টুলস, ক্লড কোড, কোডেক্স, এজেন্ট স্যান্ডবক্স, এলএলএম ইনফারেন্স, ম্যাকওএস অ্যাপস, এমসিপি সার্ভার, রাস্ট, সুইফট, পিএইচপি, পাইথন, টাইপস্ক্রিপ্ট হ্যাশট্যাগ: #opensource #githubprojects #trendinggithub #developer #programming #devtools #productivity #aiagents #aitools #claudecode #codex #workflow #automation #selfhosted [de-DE] Angesagte Open-Source-GitHub-Projekte: php-src, Impeccable, claude-mem, SPACE, DeepInfer & Filee ... 👉 AI Agents Studio: youtube.com „Dieses Video stellt die angesagtesten Open-Source-Projekte auf GitHub dieser Woche vor. Sie sehen Tools für mehr Entwicklerproduktivität, lokale Anwendungen, Performance-Optimierung und die Verbesserung von KI-Workflows. Projekte wie claude-mem, SPACE und editonny helfen Programmieragenten, sich frühere Arbeit zu merken, Code in einer Sandbox auszuführen und Videos per Konversation zu bearbeiten. Außerdem gibt es Tools für Design, Dateikonvertierung und geräteübergreifendes Arbeiten. Wenn Sie gerne nützliche Open-Source-Tools entdecken, ist dieses Update genau das Richtige für Sie.“ 👍 Liken, teilen und abonnieren Sie den Kanal für weitere Updates zu KI-Fortschritten. Hinterlassen Sie Ihre Gedanken und Fragen in den Kommentaren! 📌 Kostenlose Updates zu KI-Projekten erhalten: manuagi.beehiiv.com 📌 Wichtige KI-Tools (Affiliate-Links) 🔗 AI Voice – try.elevenlabs.io 🔗 Dzine AI kostenlos testen: dzine.ai 📌 Zeitstempel: 00:00 – Einleitung 00:53 – php-src: php/php-src 01:28 – knowledge-work-plugins: anthropics/knowledge-work-plugins 02:04 – ziwei-doushu: Renhuai123/ziwei-doushu 02:42 – rakazo: elie222/rakazo 03:18 - ai-engineering-from-scratch : rohitg00/ai-engineering-from-scratch 03:58 - impeccable : pbakaus/impeccable 04:37 - claude-mem : thedotmack/claude-mem 05:12 - php2shell-checker : openai/php2shell-checker 05:51 - free-my-tv : simbasjungles/free-my-tv 06:24 - SPACE : perplexityai/SPACE 07:01 - harp : dominikmartn/harp 07:37 - ascii-magic-art : kailashsr38/ascii-magic-art 08:18 - DeepInfer : deepseek-ai/DeepInfer 09:01 - editonny : soumatheusgomes/editonny 09:36 - fx0 : vercel-labs/fx0 10:10 - scrawl : kitlangton/scrawl 10:47 - TwinDesk : InukaAsith/TwinDesk 11:24 - git-ai : feder-cr/git-ai 11:59 - sill : Saffsanity/sill 12:35 - Filee: KnifeLemon/Filee 📈 Abonniere unseren Kanal für weitere KI-Tutorials, Tipps und Brancheneinblicke. Vergiss nicht, zu liken, zu kommentieren und mit deinen technikbegeisterten Freunden zu teilen! Tags: Trendige Open-Source-GitHub-Projekte, php-src, Impeccable, claude-mem, SPACE, DeepInfer & Filee, Open Source, Open-Source-GitHub-Projekte, Trendige GitHub-Projekte, GitHub-Projekte dieser Woche, Entwicklertools, Entwicklerproduktivität, Coding-Agenten, KI-Agenten, KI-Tools, KI-Workflow, Workflow-Automatisierung, Lokale Tools, Selbstgehostet, CLI-Tools, Claude Code, Codex, Agent Sandbox, LLM-Inferenz, macOS-Apps, MCP-Server, Rust, Swift, PHP, Python, TypeScript Hashtags: #opensource #githubprojects #trendinggithub #developer #programming #devtools #productivity #aiagents #aitools #claudecode #codex #workflow #automation #selfhosted [es-US] Proyectos de código abierto en tendencia en GitHub: php-src, Impeccable, claude-mem, SPACE, DeepI... 👉 AI Agents Studio: youtube.com "Este video presenta los proyectos de código abierto más populares de GitHub esta semana. Verás herramientas para la productividad de desarrolladores, aplicaciones optimizadas para el entorno local, mejora del rendimiento y optimización del flujo de trabajo de IA. Proyectos como claude-mem, SPACE y editonny ayudan a los agentes de programación a recordar su trabajo anterior, ejecutar código en un entorno aislado y editar videos mediante conversaciones. También hay herramientas para diseño, conversión de archivos y compatibilidad con diferentes dispositivos. Si te gusta descubrir herramientas útiles de código abierto, esta actualización es para ti." 👍 Dale me gusta, comparte y suscríbete para recibir más actualizaciones sobre los avances en IA. ¡Deja tus comentarios y preguntas abajo! 📌 Recibe actualizaciones gratuitas del proyecto de IA: manuagi.beehiiv.com 📌 Herramientas importantes de IA (enlace de afiliado) 🔗 Voz con IA: try.elevenlabs.io 🔗 Prueba Dzine AI GRATIS: dzine.ai 📌 Marcas de tiempo: 00:00 - Introducción 00:53 - php-src: php/php-src 01:28 - Complementos de trabajo del conocimiento: anthropics/knowledge-work-plugins 02:04 - ziwei-doushu: Renhuai123/ziwei-doushu 02:42 - rakazo: elie222/rakazo 03:18 - ai-engineering-from-scratch: rohitg00/ai-engineering-from-scratch 03:58 - impeccable: pbakaus/impeccable 04:37 - claude-mem: thedotmack/claude-mem 05:12 - php2shell-checker: openai/php2shell-checker 05:51 - free-my-tv: simbasjungles/free-my-tv 06:24 - SPACE: perplexityai/SPACE 07:01 - harp: dominikmartn/harp 07:37 - ascii-magic-art: kailashsr38/ascii-magic-art 08:18 - DeepInfer: deepseek-ai/DeepInfer 09:01 - editonny: soumatheusgomes/editonny 09:36 - fx0: vercel-labs/fx0 10:10 - garabato: kitlangton/scrawl 10:47 -TwinDesk: InukaAsith/TwinDesk 11:24 - git-ai: feder-cr/git-ai 11:59 - alféizar: Saffsanity/sill 12:35 - Archivo: KnifeLemon/Filee 📈 Suscríbete para más tutoriales, consejos e información del sector sobre IA. ¡No olvides darle a "Me gusta", comentar y compartir con tus amigos expertos en tecnología! Etiquetas: Proyectos de código abierto en GitHub en tendencia, php-src, Impeccable, claude-mem, SPACE, DeepInfer y Filee, código abierto, proyectos de código abierto en GitHub, proyectos de GitHub en tendencia, proyectos de GitHub de esta semana, herramientas para desarrolladores, productividad para desarrolladores, agentes de codificación, agentes de IA, herramientas de IA, flujo de trabajo de IA, automatización de flujos de trabajo, herramientas locales, autoalojado, herramientas de línea de comandos, claude code, codex, entorno aislado de agentes, inferencia LLM, aplicaciones para macOS, servidor MCP, Rust, Swift, PHP, Python, TypeScript Hashtags: #códigoabierto #proyectosdegithub #githubentendencia #desarrollador #programación #herramientasdedesarrollo #productividad #agentesdeIA #herramientasdeIA #claudecode #codex #flujodetrabajo #automatización #autoalojado [fr-FR] Projets open source GitHub tendance : php-src, Impeccable, claude-mem, SPACE, DeepInfer & Filee #303 👉 AI Agents Studio : youtube.com Cette vidéo présente les projets open source GitHub les plus populaires de la semaine. Vous y découvrirez des outils pour améliorer la productivité des développeurs, les applications locales, les performances et les flux de travail en IA. Des projets comme claude-mem, SPACE et editonny permettent aux agents de programmation de se souvenir de leur travail précédent, d'exécuter du code dans un environnement isolé et de monter des vidéos par conversation. Vous trouverez également des outils pour la conception, la conversion de fichiers et le travail multiplateforme. Si vous aimez découvrir des outils open source utiles, cette vidéo est faite pour vous ! 👍 Aimez, partagez et abonnez-vous pour suivre l'actualité de l'IA. N'hésitez pas à poser vos questions et à laisser vos commentaires ci-dessous ! 📌 Recevez gratuitement les dernières actualités sur les projets d'IA : manuagi.beehiiv.com 📌 Outils d'IA importants (lien affilié) 🔗 AI Voice : try.elevenlabs.io 🔗 Essayez Dzine AI gratuitement : dzine.ai 📌 Horodatage : 00:00 - Introduction 00:53 - php-src : php/php-src 01:28 - knowledge-work-plugins : anthropics/knowledge-work-plugins 02:04 - ziwei-doushu : Renhuai123/ziwei-doushu 02:42 - rakazo : elie222/rakazo 03:18 - ai-engineering-from-scratch : rohitg00/ai-engineering-from-scratch 03:58 - impeccable : pbakaus/impeccable 04:37 - claude-mem : thedotmack/claude-mem 05:12 - php2shell-checker : openai/php2shell-checker 05:51 - free-my-tv : simbasjungles/free-my-tv 06:24 - SPACE : perplexityai/SPACE 07:01 - harp : dominikmartn/harp 07:37 - ascii-magic-art : kailashsr38/ascii-magic-art 08:18 - DeepInfer : deepseek-ai/DeepInfer 09:01 - editonny : soumatheusgomes/editonny 09:36 - fx0 : vercel-labs/fx0 10:10 - scrawl : kitlangton/scrawl 10:47 - TwinDesk : InukaAsith/TwinDesk 11:24 - git-ai : feder-cr/git-ai 11:59 - sill : Saffsanity/sill 12:35 - Filee : KnifeLemon/Filee 📈 Abonnez-vous Pour plus de tutoriels, astuces et analyses du secteur de l'IA, n'hésitez pas à liker, commenter et partager avec vos amis férus de technologie ! Mots-clés : Projets GitHub open source tendance, php-src, Impeccable, claude-mem, SPACE, DeepInfer & Filee, open source, projets GitHub open source, projets GitHub tendance, projets GitHub de la semaine, outils de développement, productivité des développeurs, agents de codage, agents IA, outils IA, workflow IA, automatisation des workflows, outils locaux, auto-hébergement, outils CLI, Claude Code, Codex, bac à sable pour agents, inférence LLM, applications macOS, serveur MCP, Rust, Swift, PHP, Python, TypeScript Hashtags : #opensource #githubprojects #trendinggithub #developer #programming #devtools #productivity #aiagents #aitools #claudecode #codex #workflow #automation #selfhosted [hi] ट्रेडिंग ओपन-सोर्स GitHub प्रोजेक्ट्स: php-src, Impeccable, claude-mem, SPACE, DeepInfer और Filee... 👉 AI एजेंट्स स्टूडियो: youtube.com "यह वीडियो इस सप्ताह के सबसे चर्चित ओपन-सोर्स GitHub प्रोजेक्ट्स को कवर करता है। इसमें आपको डेवलपर उत्पादकता, लोकल-फर्स्ट ऐप्स, परफॉर्मेंस और AI वर्कफ़्लो में सुधार के लिए उपयोगी टूल्स देखने को मिलेंगे। claude-mem, SPACE और editonny जैसे प्रोजेक्ट कोडिंग एजेंट्स को पिछले काम को याद रखने, सैंडबॉक्स में कोड चलाने और बातचीत के ज़रिए वीडियो एडिट करने में मदद करते हैं। डिज़ाइन, फ़ाइल रूपांतरण और विभिन्न डिवाइसों पर काम करने के लिए भी टूल्स उपलब्ध हैं। अगर आपको उपयोगी ओपन-सोर्स टूल्स ढूंढना पसंद है, तो यह अपडेट आपके लिए है।" 👍 AI की प्रगति पर और अपडेट्स के लिए लाइक, शेयर और सब्सक्राइब करें। अपने विचार और प्रश्न नीचे कमेंट्स में लिखें! 📌 मुफ़्त AI प्रोजेक्ट अपडेट प्राप्त करें: manuagi.beehiiv.com 📌 महत्वपूर्ण AI उपकरण (संबद्ध लिंक) 🔗 AI वॉइस - try.elevenlabs.io 🔗 Dzine AI को मुफ़्त में आज़माएँ: dzine.ai 📌 टाइमस्टैम्प: 00:00 - परिचय भाग 00:53 - php-src: php/php-src 01:28 - knowledge-work-plugins: anthropics/knowledge-work-plugins 02:04 - ziwei-doushu: Renhuai123/ziwei-doushu 02:42 - rakazo: elie222/rakazo 03:18 - ai-engineering-from-scratch : rohitg00/ai-engineering-from-scratch 03:58 - impeccable : pbakaus/impeccable 04:37 - claude-mem : thedotmack/claude-mem 05:12 - php2shell-checker : openai/php2shell-checker 05:51 - free-my-tv : simbasjungles/free-my-tv 06:24 - SPACE : perplexityai/SPACE 07:01 - harp : dominikmartn/harp 07:37 - ascii-magic-art : kailashsr38/ascii-magic-art 08:18 - DeepInfer : deepseek-ai/DeepInfer 09:01 - editonny : soumatheusgomes/editonny 09:36 - fx0 : vercel-labs/fx0 10:10 - scrawl : kitlangton/scrawl 10:47 - TwinDesk : InukaAsith/TwinDesk 11:24 - git-ai : feder-cr/git-ai 11:59 - sill : Saffsanity/sill 12:35 - Filee : KnifeLemon/Filee 📈 AI ट्यूटोरियल, टिप्स और उद्योग से जुड़ी जानकारियों के लिए सब्सक्राइब करें। लाइक, कमेंट और अपने तकनीकी रूप से जानकार दोस्तों के साथ शेयर करना न भूलें! टैग: ट्रेंडिंग ओपन-सोर्स गिटहब प्रोजेक्ट्स, php-src, Impeccable, claude-mem, SPACE, DeepInfer और Filee, ओपन सोर्स, ओपन सोर्स गिटहब प्रोजेक्ट्स, ट्रेंडिंग गिटहब प्रोजेक्ट्स, इस सप्ताह के गिटहब प्रोजेक्ट्स, डेवलपर टूल्स, डेवलपर उत्पादकता, कोडिंग एजेंट्स, एआई एजेंट्स, एआई टूल्स, एआई वर्कफ़्लो, वर्कफ़्लो ऑटोमेशन, लोकल टूल्स, सेल्फ होस्टेड, CLI टूल्स, क्लाउड कोड, कोडेक्स, एजेंट सैंडबॉक्स, LLM इन्फरेंस, macOS ऐप्स, MCP सर्वर, रस्ट, स्विफ्ट, PHP, पायथन, टाइपस्क्रिप्ट हैशटैग: #opensource #githubprojects #trendinggithub #developer #programming #devtools #productivity #aiagents #aitools #claudecode #codex #workflow #automation #selfhosted [id] Proyek Open-Source GitHub yang Sedang Tren: php-src, Impeccable, claude-mem, SPACE, DeepInfer & F... 👉 AI Agents Studio : youtube.com "Video ini membahas proyek-proyek open-source GitHub yang sedang tren minggu ini. Anda akan melihat alat-alat untuk produktivitas pengembang, aplikasi yang mengutamakan lokal, kinerja, dan peningkatan alur kerja AI. Proyek-proyek seperti claude-mem, SPACE, dan editonny membantu agen pengkodean mengingat pekerjaan sebelumnya, menjalankan kode di sandbox, dan mengedit video melalui percakapan. Ada juga alat untuk desain, konversi file, dan bekerja lintas perangkat. Jika Anda suka menemukan alat open-source yang bermanfaat, pembaruan ini cocok untuk Anda." 👍 Sukai, bagikan, dan berlangganan untuk mendapatkan lebih banyak pembaruan tentang kemajuan AI. Sampaikan pendapat dan pertanyaan Anda di kolom komentar di bawah! 📌 Dapatkan Pembaruan Proyek AI GRATIS: manuagi.beehiiv.com 📌 Alat AI Penting (afiliasi) 🔗 AI Voice - try.elevenlabs.io 🔗Coba Dzine AI GRATIS: dzine.ai 📌 Cap Waktu: 00:00 - Bagian Pendahuluan 00:53 - php-src: php/php-src 01:28 - knowledge-work-plugins: anthropics/knowledge-work-plugins 02:04 - ziwei-doushu: Renhuai123/ziwei-doushu 02:42 - rakazo: elie222/rakazo 03:18 - ai-engineering-from-scratch : rohitg00/ai-engineering-from-scratch 03:58 - impeccable : pbakaus/impeccable 04:37 - claude-mem : thedotmack/claude-mem 05:12 - php2shell-checker : openai/php2shell-checker 05:51 - free-my-tv : simbasjungles/free-my-tv 06:24 - SPACE : perplexityai/SPACE 07:01 - harp : dominikmartn/harp 07:37 - ascii-magic-art : kailashsr38/ascii-magic-art 08:18 - DeepInfer : deepseek-ai/DeepInfer 09:01 - editonny : soumatheusgomes/editonny 09:36 - fx0 : vercel-labs/fx0 10:10 - scrawl : kitlangton/scrawl 10:47 - TwinDesk : InukaAsith/TwinDesk 11:24 - git-ai : feder-cr/git-ai 11:59 - sill : Saffsanity/sill 12:35 - Filee : KnifeLemon/Filee 📈 Berlangganan untuk tutorial AI, tips, dan informasi industri lainnya Wawasan. Jangan lupa untuk menyukai, berkomentar, dan membagikannya kepada teman-teman Anda yang paham teknologi! Tag: Proyek GitHub Open Source yang Sedang Tren, php-src, Impeccable, claude-mem, SPACE, DeepInfer & Filee, open source, proyek github open source, proyek github yang sedang tren, proyek github minggu ini, alat pengembang, produktivitas pengembang, agen pengkodean, agen AI, alat AI, alur kerja AI, otomatisasi alur kerja, alat lokal, dihosting sendiri, alat CLI, claude code, codex, sandbox agen, inferensi LLM, aplikasi macOS, server MCP, rust, swift, php, python, typescript Tagar: #opensource #githubprojects #trendinggithub #developer #programming #devtools #productivity #aiagents #aitools #claudecode #codex #workflow #automation #selfhosted [it] Progetti open source GitHub di tendenza: php-src, Impeccable, claude-mem, SPACE, DeepInfer e File... 👉 AI Agents Studio: youtube.com "Questo video presenta i progetti open source più popolari su GitHub questa settimana. Scoprirete strumenti per la produttività degli sviluppatori, app local-first, prestazioni e ottimizzazione dei flussi di lavoro AI. Progetti come claude-mem, SPACE ed editonny aiutano gli agenti di programmazione a ricordare il lavoro precedente, eseguire codice in un ambiente sandbox e modificare video tramite conversazione. Sono disponibili anche strumenti per la progettazione, la conversione di file e la compatibilità con diversi dispositivi. Se vi piace scoprire strumenti open source utili, questo aggiornamento fa al caso vostro." 👍 Mettete "Mi piace", condividete e iscrivetevi per ulteriori aggiornamenti sui progressi dell'IA. Lasciate i vostri commenti e domande qui sotto! 📌 Ricevi aggiornamenti GRATUITI sui progetti di IA: manuagi.beehiiv.com 📌 Strumenti IA importanti (link affiliato) 🔗 AI Voice - try.elevenlabs.io 🔗 Prova Dzine AI GRATIS: dzine.ai 📌 Indice dei contenuti: 00:00 - Introduzione 00:53 - php-src: php/php-src 01:28 - knowledge-work-plugins: anthropics/knowledge-work-plugins 02:04 - ziwei-doushu: Renhuai123/ziwei-doushu 02:42 - rakazo: Italiano: elie222/rakazo 03:18 - ai-engineering-from-scratch : rohitg00/ai-engineering-from-scratch 03:58 - impeccable : pbakaus/impeccable 04:37 - claude-mem : thedotmack/claude-mem 05:12 - php2shell-checker : openai/php2shell-checker 05:51 - free-my-tv : simbasjungles/free-my-tv 06:24 - SPACE : perplexityai/SPACE 07:01 - harp : Italiano: dominikmartn/harp 07:37 - ascii-magic-art : kailashsr38/ascii-magic-art 08:18 - DeepInfer : deepseek-ai/DeepInfer 09:01 - editonny : soumatheusgomes/editonny 09:36 - fx0 : vercel-labs/fx0 10:10 - scrawl : kitlangton/scrawl 10:47 - TwinDesk : InukaAsith/TwinDesk 11:24 - git-ai : feder-cr/git-ai 11:59 - sill : Italiano: Saffsanity/sill 12:35 - Filee: KnifeLemon/Filee 📈 Iscriviti per altri tutorial sull'IA, suggerimenti e approfondimenti sul settore. Non dimenticare di mettere mi piace, commentare e condividere con i tuoi amici esperti di tecnologia! Tag: Progetti open source di tendenza su GitHub, php-src, Impeccable, claude-mem, SPACE, DeepInfer e Filee, open source, progetti open source su GitHub, progetti di tendenza su GitHub, progetti di questa settimana su GitHub, strumenti per sviluppatori, produttività degli sviluppatori, agenti di programmazione, agenti AI, strumenti AI, workflow AI, automazione del workflow, strumenti locali, self-hosted, strumenti da riga di comando, claude code, codex, agent sandbox, inferenza LLM, app macOS, server MCP, Rust, Swift, PHP, Python, TypeScript Hashtag: #opensource #githubprojects #trendinggithub #developer #programming #devtools #productivity #aiagents #aitools #claudecode #codex #workflow #automation #selfhosted [iw] פרויקטי קוד פתוח מובילים ב-GitHub: php-src, Impeccable, claude-mem, SPACE, DeepInfer ו-Filee #303 👉 סטודיו לסוכני בינה מלאכותית: youtube.com "סרטון זה מכסה את פרויקטי הקוד הפתוח המובילים ב-GitHub השבוע. תראו כלים לפרודוקטיביות מפתחים, אפליקציות מקומיות, ביצועים ושיפור זרימת עבודה של בינה מלאכותית. פרויקטים כמו claude-mem, SPACE ו-editonny עוזרים לסוכני קידוד לזכור עבודות קודמות, להריץ קוד בארגז חול ולערוך וידאו באמצעות שיחה. ישנם גם כלים לעיצוב, המרת קבצים ועבודה בין מכשירים. אם אתם אוהבים למצוא כלים שימושיים בקוד פתוח, העדכון הזה הוא בשבילכם." 👍 עשו לייק, שתפו והירשמו לעדכונים נוספים על התקדמות בתחום הבינה המלאכותית. שתפו את מחשבותיכם ושאלותיכם בתגובות למטה! 📌 קבלו עדכונים בחינם על פרויקטים של בינה מלאכותית: manuagi.beehiiv.com 📌 כלי בינה מלאכותית חשובים (שותפים) 🔗 קול בינה מלאכותית - try.elevenlabs.io 🔗 נסו את Dzine AI בחינם: dzine.ai 📌 חותמות זמן: 00:00 - חלק מבוא 00:53 - php-src: php/php-src 01:28 - knowledge-work-plugins: anthropics/knowledge-work-plugins 02:04 - ziwei-doushu: Renhuai123/ziwei-doushu 02:42 - rakazo: elie222/rakazo 03:18 - ai-engineering-from-scratch : rohitg00/ai-engineering-from-scratch 03:58 - impeccable : pbakaus/impeccable 04:37 - claude-mem : thedotmack/claude-mem 05:12 - php2shell-checker : openai/php2shell-checker 05:51 - free-my-tv : simbasjungles/free-my-tv 06:24 - SPACE : perplexityai/SPACE 07:01 - harp : dominikmartn/harp 07:37 - ascii-magic-art : kailashsr38/ascii-magic-art 08:18 - DeepInfer : deepseek-ai/DeepInfer 09:01 - editonny : soumatheusgomes/editonny 09:36 - fx0 : vercel-labs/fx0 10:10 - scrawl : kitlangton/scrawl 10:47 - TwinDesk : InukaAsith/TwinDesk 11:24 - git-ai : feder-cr/git-ai 11:59 - סיל : Saffsanity/sill 12:35 - Filee : KnifeLemon/Filee 📈 הירשמו לעוד מדריכים, טיפים ותובנות על בינה מלאכותית. אל תשכחו לעשות לייק, להגיב ולשתף עם חברים שמבינים בטכנולוגיה! תגיות: פרויקטים פופולריים בקוד פתוח של Github, php-src, Impeccable, claude-mem, SPACE, DeepInfer & Filee, קוד פתוח, פרויקטים פופולריים בקוד פתוח של Github, פרויקטים פופולריים ב-Github השבוע, כלי פיתוח, פרודוקטיביות מפתחים, סוכני קידוד, סוכני בינה מלאכותית, כלי בינה מלאכותית, זרימת עבודה של בינה מלאכותית, אוטומציה של זרימת עבודה, כלים מקומיים, אירוח עצמי, כלי cli, קוד claude, codex, ארגז חול של סוכנים, הסקה llm, אפליקציות macos, שרת mcp, rust, swift, php, python, typescript האשטגים: #קוד פתוח #פרויקטים_ב_Github #מגמת_Github #מפתח #תכנות #כלי_פיתוח #פרודוקטיביות #סוכני_בינה_איי #כלי_איי #claudecode #codex #זרימת_עבודה #אוטומציה #אירוח_עצמי [ja] 話題のオープンソースGitHubプロジェクト：php-src、Impeccable、claude-mem、SPACE、DeepInfer & Filee #303 👉 AI Agents Studio : youtube.com 「この動画では、今週最も注目を集めているGitHubのオープンソースプロジェクトをご紹介します。開発者の生産性向上、ローカルファーストのアプリ開発、パフォーマンス向上、AIワークフロー改善のためのツールをご覧いただけます。claude-mem、SPACE、editonnyといったプロジェクトは、コーディングエージェントが過去の作業を記憶したり、サンドボックスでコードを実行したり、会話を通じて動画を編集したりするのに役立ちます。デザイン、ファイル変換、デバイス間連携のためのツールもあります。便利なオープンソースツールを探している方は、ぜひこのアップデートをご覧ください。」 👍 AIの進歩に関する最新情報をもっと知りたい方は、いいね、シェア、チャンネル登録をお願いします。ご意見やご質問は下のコメント欄にお寄せください！ 📌 AIプロジェクトの最新情報を無料で入手：manuagi.beehiiv.com 📌 重要なAIツール（アフィリエイト） 🔗 AI Voice - try.elevenlabs.io 🔗 Dzine AIを無料で試す：dzine.ai 📌 タイムスタンプ： 00:00 - イントロ 00:53 - php-src：php/php-src 01:28 - knowledge-work-plugins：anthropics/knowledge-work-plugins 02:04 - ziwei-doushu：Renhuai123/ziwei-doushu 02:42 - rakazo： elie222/rakazo 03:18 - ai-engineering-from-scratch : rohitg00/ai-engineering-from-scratch 03:58 - impeccable : pbakaus/impeccable 04:37 - claude-mem : thedotmack/claude-mem 05:12 - php2shell-checker : openai/php2shell-checker 05:51 - free-my-tv : simbasjungles/free-my-tv 06:24 - SPACE : perplexityai/SPACE 07:01 - harp : dominikmartn/harp 07:37 - アスキーマジックアート : kailashsr38/ascii-magic-art 08:18 - DeepInfer : deepseek-ai/DeepInfer 09:01 - editonny : soumatheusgomes/editonny 09:36 - fx0 : vercel-labs/fx0 10:10 - 走り書き : kitlangton/scrawl 10:47 -TwinDesk : InukaAsith/TwinDesk 11:24 - git-ai : feder-cr/git-ai 11:59 - シル: Saffsanity/sill 12:35 - ファイル: KnifeLemon/Filee 📈 AIチュートリアル、ヒント、業界情報など、さらに多くのコンテンツをお届けしますので、ぜひチャンネル登録をお願いします。いいね、コメント、そしてテクノロジーに詳しいお友達とのシェアもお忘れなく！ タグ: トレンドのオープンソースGitHubプロジェクト、php-src、Impeccable、claude-mem、SPACE、DeepInfer & Filee、オープンソース、オープンソースGitHubプロジェクト、トレンドのGitHubプロジェクト、今週のGitHubプロジェクト、開発者ツール、開発者の生産性、コーディングエージェント、AIエージェント、AIツール、AIワークフロー、ワークフロー自動化、ローカルツール、セルフホスト、CLIツール、Claude Code、Codex、エージェントサンドボックス、LLM推論、macOSアプリ、MCPサーバー、Rust、Swift、PHP、Python、TypeScript ハッシュタグ: #opensource #githubprojects #trendinggithub #developer #programming #devtools #productivity #aiagents #aitools #claudecode #codex #workflow #automation #selfhosted [ko] 주목받는 오픈소스 GitHub 프로젝트: php-src, Impeccable, claude-mem, SPACE, DeepInfer & Filee #303 👉 AI 에이전트 스튜디오 : youtube.com "이 영상에서는 이번 주 가장 인기 있는 오픈소스 GitHub 프로젝트들을 소개합니다. 개발자 생산성 향상, 로컬 우선 앱 개발, 성능 개선, AI 워크플로우 개선을 위한 도구들을 만나보실 수 있습니다. claude-mem, SPACE, editonny와 같은 프로젝트들은 코딩 에이전트가 이전 작업을 기억하고, 샌드박스 환경에서 코드를 실행하고, 대화를 통해 비디오를 편집할 수 있도록 도와줍니다. 디자인, 파일 변환, 다양한 기기와의 협업을 위한 도구들도 있습니다. 유용한 오픈소스 도구를 찾고 있다면 이번 업데이트가 도움이 될 것입니다." 👍 좋아요, 공유, 구독 부탁드립니다! 더 많은 AI 발전 소식을 받아보세요. 댓글에 의견이나 질문을 남겨주세요! 📌 무료 AI 프로젝트 업데이트 받기: manuagi.beehiiv.com 📌 주요 AI 도구 (제휴 링크) 🔗 AI Voice - try.elevenlabs.io 🔗 Dzine AI 무료 체험: dzine.ai 📌 타임스탬프: 00:00 - 소개 00:53 - php-src : php/php-src 01:28 - knowledge-work-plugins : anthropics/knowledge-work-plugins 02:04 - ziwei-doushu : Renhuai123/ziwei-doushu 02:42 - rakazo : elie222/rakazo 03:18 - ai-engineering-from-scratch : rohitg00/ai-engineering-from-scratch 03:58 - impeccable : pbakaus/impeccable 04:37 - claude-mem : thedotmack/claude-mem 05:12 - php2shell-checker : openai/php2shell-checker 05:51 - free-my-tv : simbasjungles/free-my-tv 06:24 - SPACE : perplexityai/SPACE 07:01 - harp : dominikmartn/harp 07:37 - ascii-magic-art : kailashsr38/ascii-magic-art 08:18 - DeepInfer : deepseek-ai/DeepInfer 09:01 - 에디토니 : soumatheusgomes/editonny 09:36 - fx0 : vercel-labs/fx0 10:10 - 스크롤 : kitlangton/scrawl 10:47 -TwinDesk : InukaAsith/TwinDesk 11:24 - git-ai : feder-cr/git-ai 11:59 - 씰 : Saffsanity/sill 12:35 - 파일리: KnifeLemon/Filee 📈 더 많은 AI 튜토리얼, 팁, 업계 인사이트를 보려면 구독하세요. 좋아요, 댓글, 그리고 기술에 정통한 친구들과 공유하는 것도 잊지 마세요! 태그: 인기 오픈소스 깃허브 프로젝트, php-src, Impeccable, claude-mem, SPACE, DeepInfer & Filee, 오픈소스, 오픈소스 깃허브 프로젝트, 인기 깃허브 프로젝트, 이번 주 깃허브 프로젝트, 개발자 도구, 개발자 생산성, 코딩 에이전트, AI 에이전트, AI 도구, AI 워크플로, 워크플로 자동화, 로컬 도구, 자체 호스팅, CLI 도구, Claude Code, Codex, 에이전트 샌드박스, LLM 추론, macOS 앱, MCP 서버, Rust, Swift, PHP, Python, TypeScript 해시태그: #opensource #githubprojects #trendinggithub #developer #programming #devtools #productivity #aiagents #aitools #claudecode #codex #workflow #automation #selfhosted [ml] ട്രെൻഡിംഗ് ഓപ്പൺ-സോഴ്സ് ഗിറ്റ്‌ഹബ് പ്രോജക്റ്റുകൾ: php-src, Impeccable, claude-mem, SPACE, DeepInf... 👉 AI ഏജന്റ്സ് സ്റ്റുഡിയോ : youtube.com "ഈ വീഡിയോയിൽ ഈ ആഴ്ചയിലെ ഏറ്റവും മികച്ച ട്രെൻഡിംഗ് ഓപ്പൺ സോഴ്‌സ് GitHub പ്രോജക്റ്റുകൾ ഉൾപ്പെടുന്നു. ഡെവലപ്പർ ഉൽപ്പാദനക്ഷമത, ലോക്കൽ-ഫസ്റ്റ് ആപ്പുകൾ, പ്രകടനം, AI വർക്ക്ഫ്ലോ മെച്ചപ്പെടുത്തൽ എന്നിവയ്ക്കുള്ള ടൂളുകൾ നിങ്ങൾ കാണും. ക്ലോഡ്-മെം, സ്‌പെയ്‌സ്, എഡിറ്റോണി തുടങ്ങിയ പ്രോജക്റ്റുകൾ കോഡിംഗ് ഏജന്റുമാരെ മുൻകാല പ്രവർത്തനങ്ങൾ ഓർമ്മിക്കാനും സാൻഡ്‌ബോക്‌സിൽ കോഡ് പ്രവർത്തിപ്പിക്കാനും സംഭാഷണത്തിലൂടെ വീഡിയോ എഡിറ്റ് ചെയ്യാനും സഹായിക്കുന്നു. ഡിസൈൻ, ഫയൽ പരിവർത്തനം, ഉപകരണങ്ങളിലുടനീളം പ്രവർത്തിക്കൽ എന്നിവയ്‌ക്കുള്ള ടൂളുകളും ഉണ്ട്. ഉപയോഗപ്രദമായ ഓപ്പൺ സോഴ്‌സ് ടൂളുകൾ കണ്ടെത്താൻ നിങ്ങൾ ആഗ്രഹിക്കുന്നുവെങ്കിൽ, ഈ അപ്‌ഡേറ്റ് നിങ്ങൾക്കുള്ളതാണ്." 👍 AI പുരോഗതികളെക്കുറിച്ചുള്ള കൂടുതൽ അപ്‌ഡേറ്റുകൾക്കായി ലൈക്ക് ചെയ്യുക, പങ്കിടുക, സബ്‌സ്‌ക്രൈബുചെയ്യുക. നിങ്ങളുടെ ചിന്തകളും ചോദ്യങ്ങളും താഴെയുള്ള അഭിപ്രായങ്ങളിൽ ഇടുക! 📌 സൗജന്യ AI പ്രോജക്റ്റ് അപ്‌ഡേറ്റുകൾ നേടൂ : manuagi.beehiiv.com 📌 പ്രധാനപ്പെട്ട AI ടൂളുകൾ (അഫിലിയേറ്റ്) 🔗 AI വോയ്‌സ് - try.elevenlabs.io 🔗Dzine AI സൗജന്യമായി പരീക്ഷിച്ചുനോക്കൂ : dzine.ai 📌 ടൈംസ്റ്റാമ്പുകൾ : 00:00 - ആമുഖ ഭാഗം 00:53 - php-src : php/php-src 01:28 - knowledge-work-plugins : anthropics/knowledge-work-plugins 02:04 - ziwei-doushu : Renhuai123/ziwei-doushu 02:42 - rakazo : elie222/rakazo 03:18 - ai-engineering-from-scratch : rohitg00/ai-engineering-from-scratch 03:58 - കുറ്റമറ്റത് : pbakaus/impeccable 04:37 - claude-mem : thedotmack/claude-mem 05:12 - php2shell-checker : openai/php2shell-checker 05:51 - free-my-tv : simbasjungles/free-my-tv 06:24 - SPACE : perplexityai/SPACE 07:01 - harp : dominikmartn/harp 07:37 - ascii-magic-art : kailashsr38/ascii-magic-art 08:18 - DeepInfer : deepseek-ai/DeepInfer 09:01 - എഡിറ്റോണി : soumatheusgomes/editonny 09:36 - fx0 : vercel-labs/fx0 10:10 - സ്‌ക്രാൾ : kitlangton/scrawl 10:47 -TwinDesk : InukaAsith/TwinDesk 11:24 - git-ai : feder-cr/git-ai 11:59 - സിൽ : Saffsanity/sill 12:35 - ഫയൽ: KnifeLemon/Filee 📈 കൂടുതൽ AI ട്യൂട്ടോറിയലുകൾ, നുറുങ്ങുകൾ, വ്യവസായ ഉൾക്കാഴ്ചകൾ എന്നിവയ്ക്കായി സബ്‌സ്‌ക്രൈബ് ചെയ്യുക. ലൈക്ക് ചെയ്യാനും കമന്റ് ചെയ്യാനും നിങ്ങളുടെ സാങ്കേതിക വിദഗ്ദ്ധരായ സുഹൃത്തുക്കളുമായി പങ്കിടാനും മറക്കരുത്! ടാഗുകൾ: ട്രെൻഡിംഗ് ഓപ്പൺ-സോഴ്‌സ് ഗിത്തബ് പ്രോജക്റ്റുകൾ, php-src, ഇംപെക്കബിൾ, ക്ലോഡ്-മെം, സ്‌പെയ്‌സ്, ഡീപ്പ്ഇൻഫർ & ഫയലി, ഓപ്പൺ സോഴ്‌സ്, ഓപ്പൺ സോഴ്‌സ് ഗിത്തബ് പ്രോജക്റ്റുകൾ, ട്രെൻഡിംഗ് ഗിത്തബ് പ്രോജക്റ്റുകൾ, ഈ ആഴ്ചയിലെ ഗിത്തബ് പ്രോജക്റ്റുകൾ, ഡെവലപ്പർ ടൂളുകൾ, ഡെവലപ്പർ പ്രൊഡക്ടിവിറ്റി, കോഡിംഗ് ഏജന്റുകൾ, AI ഏജന്റുകൾ, AI ടൂളുകൾ, AI വർക്ക്ഫ്ലോ, വർക്ക്ഫ്ലോ ഓട്ടോമേഷൻ, ലോക്കൽ ടൂളുകൾ, സെൽഫ് ഹോസ്റ്റഡ്, CLI ടൂളുകൾ, ക്ലോഡ് കോഡ്, കോഡെക്സ്, ഏജന്റ് സാൻഡ്‌ബോക്‌സ്, llm അനുമാനം, മാകോസ് ആപ്പുകൾ, mcp സെർവർ, റസ്റ്റ്, സ്വിഫ്റ്റ്, php, പൈത്തൺ, ടൈപ്പ്‌സ്ക്രിപ്റ്റ് ഹാഷ്‌ടാഗുകൾ: #opensource #githubprojects #trendinggithub #developer #programming #devtools #productivity #aiagents #aitools #claudecode #codex #workflow #automation #selfhosted [nl-NL] Populaire open-source GitHub-projecten: php-src, Impeccable, claude-mem, SPACE, DeepInfer & Filee... 👉 AI Agents Studio: youtube.com "Deze video behandelt de meest trending open-source GitHub-projecten van deze week. Je ziet tools voor productiviteit van ontwikkelaars, lokaal geoptimaliseerde apps, prestaties en AI-workflowverbetering. Projecten zoals claude-mem, SPACE en editonny helpen codeeragenten om eerder werk te onthouden, code in een sandbox uit te voeren en video te bewerken via conversatie. Er zijn ook tools voor ontwerp, bestandsconversie en werken op verschillende apparaten. Als je graag nuttige open-source tools ontdekt, is deze update iets voor jou." 👍 Like, deel en abonneer je voor meer updates over AI-ontwikkelingen. Laat je gedachten en vragen achter in de reacties hieronder! 📌 Ontvang GRATIS updates over AI-projecten: manuagi.beehiiv.com 📌 Belangrijke AI-tools (affiliate) 🔗 AI Voice - try.elevenlabs.io 🔗 Probeer Dzine AI GRATIS: dzine.ai 📌 Tijdstempels: 00:00 - Introductie 00:53 - php-src: php/php-src 01:28 - knowledge-work-plugins: anthropics/knowledge-work-plugins 02:04 - ziwei-doushu: Renhuai123/ziwei-doushu 02:42 - rakazo: elie222/rakazo 03:18 - ai-engineering-from-scratch: rohitg00/ai-engineering-from-scratch 03:58 - impeccable: pbakaus/impeccable 04:37 - claude-mem: thedotmack/claude-mem 05:12 - php2shell-checker: openai/php2shell-checker 05:51 - free-my-tv: simbasjungles/free-my-tv 06:24 - SPACE: perplexityai/SPACE 07:01 - harp: dominikmartn/harp 07:37 - ascii-magic-art: kailashsr38/ascii-magic-art 08:18 - DeepInfer: deepseek-ai/DeepInfer 09:01 - editonny: soumatheusgomes/editonny 09:36 - fx0: vercel-labs/fx0 10:10 - krabbel: kitlangton/scrawl 10:47 -TwinDesk: InukaAsith/TwinDesk 11:24 - git-ai: feder-cr/git-ai 11:59 - dorpel: Saffsanity/sill 12:35 - Bestand: KnifeLemon/Filee 📈 Abonneer je voor meer AI-tutorials, tips en inzichten uit de branche. Vergeet niet te liken, te reageren en te delen met je technisch onderlegde vrienden! Tags: ... [pa] ਟਰੈਂਡਿੰਗ ਓਪਨ-ਸੋਰਸ GitHub ਪ੍ਰੋਜੈਕਟ: php-src, Impeccable, claude-mem, SPACE, DeepInfer ਅਤੇ Filee #303 👉 AI ਏਜੰਟ ਸਟੂਡੀਓ : youtube.com "ਇਹ ਵੀਡੀਓ ਇਸ ਹਫ਼ਤੇ ਦੇ ਸਭ ਤੋਂ ਪ੍ਰਚਲਿਤ ਓਪਨ-ਸੋਰਸ GitHub ਪ੍ਰੋਜੈਕਟਾਂ ਨੂੰ ਕਵਰ ਕਰਦਾ ਹੈ। ਤੁਸੀਂ ਡਿਵੈਲਪਰ ਉਤਪਾਦਕਤਾ, ਸਥਾਨਕ-ਪਹਿਲੇ ਐਪਸ, ਪ੍ਰਦਰਸ਼ਨ, ਅਤੇ AI ਵਰਕਫਲੋ ਸੁਧਾਰ ਲਈ ਟੂਲ ਦੇਖੋਗੇ। claude-mem, SPACE, ਅਤੇ editonny ਵਰਗੇ ਪ੍ਰੋਜੈਕਟ ਕੋਡਿੰਗ ਏਜੰਟਾਂ ਨੂੰ ਪਿਛਲੇ ਕੰਮ ਨੂੰ ਯਾਦ ਰੱਖਣ, ਸੈਂਡਬੌਕਸ ਵਿੱਚ ਕੋਡ ਚਲਾਉਣ ਅਤੇ ਗੱਲਬਾਤ ਰਾਹੀਂ ਵੀਡੀਓ ਨੂੰ ਸੰਪਾਦਿਤ ਕਰਨ ਵਿੱਚ ਮਦਦ ਕਰਦੇ ਹਨ। ਡਿਜ਼ਾਈਨ, ਫਾਈਲ ਪਰਿਵਰਤਨ, ਅਤੇ ਡਿਵਾਈਸਾਂ ਵਿੱਚ ਕੰਮ ਕਰਨ ਲਈ ਟੂਲ ਵੀ ਹਨ। ਜੇਕਰ ਤੁਸੀਂ ਉਪਯੋਗੀ ਓਪਨ-ਸੋਰਸ ਟੂਲ ਲੱਭਣਾ ਪਸੰਦ ਕਰਦੇ ਹੋ, ਤਾਂ ਇਹ ਅਪਡੇਟ ਤੁਹਾਡੇ ਲਈ ਹੈ।" 👍 AI ਤਰੱਕੀਆਂ ਬਾਰੇ ਹੋਰ ਅਪਡੇਟਾਂ ਲਈ ਲਾਈਕ, ਸ਼ੇਅਰ ਅਤੇ ਸਬਸਕ੍ਰਾਈਬ ਕਰੋ। ਹੇਠਾਂ ਟਿੱਪਣੀਆਂ ਵਿੱਚ ਆਪਣੇ ਵਿਚਾਰ ਅਤੇ ਸਵਾਲ ਛੱਡੋ! 📌 ਮੁਫ਼ਤ AI ਪ੍ਰੋਜੈਕਟ ਅੱਪਡੇਟ ਪ੍ਰਾਪਤ ਕਰੋ: manuagi.beehiiv.com 📌 ਮਹੱਤਵਪੂਰਨ AI ਟੂਲ (ਐਫੀਲੀਏਟ) 🔗 AI ਵੌਇਸ - try.elevenlabs.io 🔗Dzine AI ਮੁਫ਼ਤ ਅਜ਼ਮਾਓ: dzine.ai 📌 ਟਾਈਮਸਟੈਂਪ: 00:00 - ਜਾਣ-ਪਛਾਣ ਭਾਗ 00:53 - php-src : php/php-src 01:28 - knowledge-work-plugins : anthropics/knowledge-work-plugins 02:04 - ziwei-doushu : Renhuai123/ziwei-doushu 02:42 - rakazo : elie222/rakazo 03:18 - ai-engineering-from-scratch : rohitg00/ai-engineering-from-scratch 03:58 - ਬੇਦਾਗ਼ : pbakaus/impeccable 04:37 - claude-mem : thedotmack/claude-mem 05:12 - php2shell-checker : openai/php2shell-checker 05:51 - free-my-tv : simbasjungles/free-my-tv 06:24 - ਸਪੇਸ : perplexityai/SPACE 07:01 - harp : dominikmartn/harp 07:37 - ascii-magic-art : kailashsr38/ascii-magic-art 08:18 - DeepInfer : deepseek-ai/DeepInfer 09:01 - editonny : soumatheusgomes/editonny 09:36 - fx0 : vercel-labs/fx0 10:10 - scrawl : kitlangton/scrawl 10:47 -TwinDesk : InukaAsith/TwinDesk 11:24 - git-ai : feder-cr/git-ai 11:59 - sill : Saffsanity/sill 12:35 - Filee : KnifeLemon/Filee 📈 ਹੋਰ AI ਟਿਊਟੋਰਿਅਲ, ਸੁਝਾਅ ਅਤੇ ਉਦਯੋਗ ਲਈ ਸਬਸਕ੍ਰਾਈਬ ਕਰੋ ਸੂਝ-ਬੂਝ। ਆਪਣੇ ਤਕਨੀਕੀ-ਸਮਝਦਾਰ ਦੋਸਤਾਂ ਨਾਲ ਲਾਈਕ, ਟਿੱਪਣੀ ਅਤੇ ਸਾਂਝਾ ਕਰਨਾ ਨਾ ਭੁੱਲੋ! ਟੈਗਸ: ਟ੍ਰੈਂਡਿੰਗ ਓਪਨ-ਸੋਰਸ ਗਿਥਬ ਪ੍ਰੋਜੈਕਟਸ, php-src, Impeccable, claude-mem, SPACE, DeepInfer & Filee, ਓਪਨ ਸੋਰਸ, ਓਪਨ ਸੋਰਸ ਗਿਥਬ ਪ੍ਰੋਜੈਕਟਸ, ਟ੍ਰੈਂਡਿੰਗ ਗਿਥਬ ਪ੍ਰੋਜੈਕਟਸ, ਇਸ ਹਫਤੇ ਗਿਥਬ ਪ੍ਰੋਜੈਕਟਸ, ਡਿਵੈਲਪਰ ਟੂਲਸ, ਡਿਵੈਲਪਰ ਉਤਪਾਦਕਤਾ, ਕੋਡਿੰਗ ਏਜੰਟ, ai ਏਜੰਟ, ai ਟੂਲਸ, ai ਵਰਕਫਲੋ, ਵਰਕਫਲੋ ਆਟੋਮੇਸ਼ਨ, ਲੋਕਲ ਟੂਲਸ, ਸੈਲਫ ਹੋਸਟਡ, cli ਟੂਲਸ, ਕਲਾਉਡ ਕੋਡ, ਕੋਡੈਕਸ, ਏਜੰਟ ਸੈਂਡਬੌਕਸ, llm ਇਨਫਰੈਂਸ, ਮੈਕੋਸ ਐਪਸ, mcp ਸਰਵਰ, ਰਸਟ, ਸਵਿਫਟ, php, ਪਾਈਥਨ, ਟਾਈਪਸਕ੍ਰਿਪਟ ਹੈਸ਼ਟੈਗਸ: #opensource #githubprojects #trendinggithub #developer #programming #devtools #productivity #aiagents #aitools #claudecode #codex #workflow #automatation #selfhosted [pl] Popularne projekty open-source na GitHubie: php-src, Impeccable, claude-mem, SPACE, DeepInfer i F... 👉 AI Agents Studio: youtube.com „Ten film omawia najpopularniejsze projekty open source na GitHubie w tym tygodniu. Zobaczysz narzędzia do zwiększania produktywności programistów, aplikacji lokalnych, wydajności i usprawniania przepływu pracy z AI. Projekty takie jak claude-mem, SPACE i editonny pomagają agentom programistycznym zapamiętywać wcześniejsze prace, uruchamiać kod w piaskownicy i edytować wideo poprzez konwersację. Dostępne są również narzędzia do projektowania, konwersji plików i pracy na wielu urządzeniach. Jeśli lubisz znajdować przydatne narzędzia open source, ta aktualizacja jest dla Ciebie”. 👍 Polub, udostępnij i zasubskrybuj, aby otrzymywać więcej informacji o postępach w dziedzinie AI. Podziel się swoimi przemyśleniami i pytaniami w komentarzach poniżej! 📌 Otrzymuj BEZPŁATNE aktualizacje projektów AI: manuagi.beehiiv.com 📌 Ważne narzędzia AI (program partnerski) 🔗 Głos AI - try.elevenlabs.io 🔗 Wypróbuj Dzine AI ZA DARMO: dzine.ai 📌 Znaczniki czasu: 00:00 - Część wprowadzająca 00:53 - php-src: php/php-src 01:28 - knowledge-work-plugins: anthropics/knowledge-work-plugins 02:04 - ziwei-doushu: Renhuai123/ziwei-doushu 02:42 - rakazo: elie222/rakazo 03:18 - inżynieria-sztucznej-inżynierii-od-scratch: rohitg00/in%C5%BCynieria-sztucznej-in%C5%BCynierii-od-scratch 03:58 - impeccable: pbakaus/impeccable 04:37 - claude-mem: thedotmack/claude-mem 05:12 - php2shell-checker: openai/php2shell-checker 05:51 - free-my-tv: simbasjungles/free-my-tv 06:24 - SPACE: perplexityai/SPACE 07:01 - harfa: dominikmartn/harp 07:37 - ascii-magic-art: kailashsr38/ascii-magic-art 08:18 - DeepInfer: deepseek-ai/DeepInfer 09:01 - editonny: soumatheusgomes/editonny 09:36 - fx0: vercel-labs/fx0 10:10 - scrawl: kitlangton/scrawl 10:47 - TwinDesk: InukaAsith/TwinDesk 11:24 - git-ai: feder-cr/git-ai 11:59 - sill: Saffsanity/sill 12:35 - Filee: KnifeLemon/Filee 📈 Subskrybuj, aby otrzymywać więcej samouczków, wskazówek i informacji branżowych dotyczących sztucznej inteligencji. Nie zapomnij polubić, skomentować i udostępnić znajomym, którzy interesują się technologią! Tagi: Popularne projekty open source na GitHubie, php-src, Impeccable, claude-mem, SPACE, DeepInfer i Filee, open source, projekty open source na GitHubie, popularne projekty na GitHubie, projekty GitHubie w tym tygodniu, narzędzia programistyczne, produktywność programistów, agenci kodowania, agenci AI, narzędzia AI, przepływ pracy AI, automatyzacja przepływu pracy, narzędzia lokalne, własny hosting, narzędzia CLI, kod Claude'a, Codex, piaskownica agenta, wnioskowanie LLM, aplikacje macOS, serwer MCP, Rust, Swift, PHP, Python, TypeScript Hashtagi: #opensource #projektyGitHub #trendyGitHub #programista #programowanie #narzędziaprogramistyczne #produktywność #aiagents #aitools #claudecode #codex #przepływ pracy #automatyzacja #własny hosting [pt-BR] Projetos Open-Source em Alta no GitHub: php-src, Impeccable, claude-mem, SPACE, DeepInfer e Filee... 👉 AI Agents Studio: youtube.com "Este vídeo aborda os principais projetos de código aberto do GitHub desta semana. Você verá ferramentas para produtividade de desenvolvedores, aplicativos com foco em execução local, desempenho e aprimoramento do fluxo de

ThursdAI - Oct 22 - AI finds all the vulnerabilities, Claude Duet, DeepSeek drops Infer & more AI news Hey, Welcome to what cybersecurity experts are calling “Black October” - after a series of critical vulnerabilities that allow remote execution were found in PHP and Node.js, several companies were hacked, and a new supply chain attack on the very popular LiteLLM library was acknowledged. The internet is freaking out, and we’ve tried to make sense of it all, with a security expert Josh Long on the show. Also this week, Anthropic stepped into the personal agent category with Claude Duet, their direct competitor to Dots from OpenAI, Muse from Meta etc’. Duet is proactive and always on, and can do work while you’re asleep! I got access this morning so this isn’t the full review yet. Also DeepSeek is back with a new model and their inference engine! Let’s dive in: Subscribe now {% embed youtube.com %} Claude Duet - a personal agent powered by Opus 5.5 and doesn’t wait for you (X, Product, Blog) {% embed youtube.com %}  To me this is the most exciting announcement of the week (which otherwise was full of doom and gloom). Anthropic finally stepped into the personal agent category! Shipping Claude Duet, as a separate mobile app, and its own online UI (claude.ai) which is what I was missing from OpenAI’s Dots! Duet is built around Opus 5.5, brings over your existing memory, skills and connected apps, and reaches into 6,000+ connectors and plugins on their platform. Every few hours it checks your accounts, surfaces what needs you, and does the task from its own cloud computer, laptop closed. The rest is pretty much the same, similar UI, similar features to others, just with Claude taste and intelligence. It can somehow interact with Claude Code but not fully, so it can’t be used as a chief of staff. This seems like a weak link given just how much folks are using Claude Code. Claude Duet is also not personal at all, I didn’t find a way to rename it or make it “mine”, it doesn’t seem to do any phone calls. So for now, it’s a great start, but definitely not replacing Muse for me. Hot take: Anthropic is following in this category, not leading. OpenClaw and Hermes worked best with Anthropic models, then Anthropic cut off subscription access for them, and now we finally see why. Every lab has a personal agent now: Dots, Muse (still leading for me), Grok Bot, and Google’s Spark, which most people don’t even know exists. Nisten says Dots “feels like that government employee that tries to avoid all responsibility”, while Muse is “so energetic”. LDJ finds Dots a net positive. My big realization: switching personal agents is WAY harder than switching coding harnesses. Once your assistant knows everything about you, moving takes a lot of effort for the human. If you only copy over the memories/context, then you have two/three AI assistants doing the same work, sending you the same notifications and all updating you about the same emails. Black October: the densest and scariest security week I can remember {% embed youtube.com %} Some folks are calling this month Black October, and it’s one of the worst I can remember. Some bugs were found by AI, some attacks are run by AI (Microsoft says a China state-aligned group used an agentic pentest framework called ARTEX against hundreds of organizations), and some attackers are just going after your AI keys. Security expert Josh Long joined to keep us sane, with an attempt of positivity though it wasn’t easy! PHP2Shell - AI helped find holes in the language that runs 70% of websites (Wiz, OpenAI, Blog, Calif, CISA, Checker)  This was one of the hugest things that shook the industry this week! PHP runs an estimated 70% of websites, and two bugs in the language engine itself let an attacker send one request, no login, and potentially take over the server with code execution ability. CVSS 9.2, every release back to 5.4. It is really important that if you are running anything on a PHP server, that you patch it right away. Ask your agents to do a security audit. This vulnerability was present in the PHP code for 14 years! Calif found the first bug in an audit funded through OpenAI’s Patch the Planet initiative. Josh says several groups finding the same bugs independently is rare, his advice was refreshingly calm: if you run a PHP server, you should have patched yesterday, no excuses. Cloudflare invented a new form of WAF to block it for all websites that are protected by Cloudflare and the big cloud companies patched right away, so regular folks browsing the web can go about their daily business.  Still, a lot of websites that are run on PHP and aren’t able to patch, their IT guy quit, or they lost the keys to their servers, and your information can be at risk of getting stolen. Personal security actions like locking down your credit (if you’re in US), rotating passwords, having a password manager is always a good idea. OpenAI Daybreak - the defenders got the good models (X, Infosecurity) Back in August, post the HuggingFace hack, Greg Brockman penned “the defenders window“, where he outlined that Defenders need access to the best models, with lower safeguards to get ahead of the attackers. It seems that this defenders window was starting to close this week, given the hacks that happened in addition to the PHP2Shell vulnerability disclosure, which for the record, wasn’t a hack! OpenAI’s Daybreak blue gave vetted researchers GPT-5.6 Sol with loosened safeguards (and GPT-5.6-Cyber on the Red tier), and Hacktron’s s1r1us credits it for a run of finds: a HEIF heist, a KVM escape, PHP2Shell, GitLab RCEs, a full Chrome chain and a WordPress RCE. Greg Brockman calls this the Defender’s Window, and it does feel like it’s closing. Railway and OpenCode: someone is always hunting your AI keys (Railway, OpenCode)  OpenCode got hacked about a week ago, and now Railway too, and what the attackers seem to be after is your LLM API keys. The main reason is, API keys can be immediately sold on the black market and used for distillation. They are immediately and immensely valuable. Think about it. Your personal data is probably on the dark web already, I’m not sure how much your SSN is even worth right now. But an OpenAI or Anthropic key without a limit on it is basically direct access to your credit card, and there are people buying those keys on the black market for distillation. If you had keys on either service, invalidate, rotate them and make sure to have separate keys for each service despite how much pain in the A it is. Also always add a limit! If only there was a more secure way to make machines talk to other machines!? Turns out, there is, it’s called OIDC, it just wasn’t implemented yet by anyone besides the big companies. It’s more complex than just minting a simple API key and pasting it into a file, but it’s definitely the right way to go! eMudhra - root certificates with a private key of... 4? (X, Cloudflare) The other big one this week has nothing to do with AI, it’s just plain human negligence. eMudhra is one of the certificate authorities your browser trusts to sign HTTPS certificates, and it turns out some of their root certificates were created with a trivial private key (Cloudflare’s Matthew Prince says it was literally the number 4!). Anyone who figures that out can mint a “valid” certificate for any website, and your browser would happily trust it. Josh (who wrote about DigiNotar back in 2011, a very similar mess) walked us through what this means in practice, and it’s less scary than the timeline makes it sound. To abuse this, an attacker has to sit in the middle of your connection, think sketchy coffee shop Wi-Fi, and only then can they pretend to be Google.com and read traffic you thought was encrypted. Chrome, Brave, Edge and Firefox have already removed eMudhra’s roots, and Safari is lagging behind because Apple takes its time with patches. So update your browser and your OS, and you’re good. Nisten has a theory that the key was changed by hand during the signing ceremony, because “if it was an LLM, it would have at least done something better” 😂 LiteLLM 1.107.0 - a supply chain attack that steals your keys (Wiz, StepSecurity)  And as if that wasn’t enough, LiteLLM, the very popular Python library a lot of us use to route between LLM providers, shipped a poisoned 1.107.0 release with a credential stealer that grabs your cloud, SSH and LLM keys. It was live for about an hour and forty minutes. If you installed it, go back to 1.106.2 and rotate everything. Josh pointed out the irony: the folks who followed best practice and updated right away are exactly the ones who got hit. How to protect yourself (and your agents) this week (Eito’s checklist) “Update everything immediately” is not simple advice anymore, so here’s the distinction we landed on during the show. Your browser, OS and phone: hit that update notification right away. PHP and Node on your servers: patch now. But package managers like pip, uv and npm are where supply chain attacks live, so don’t install a package version that’s less than 24 hours old, which gives maintainers time to pull a poisoned release like the LiteLLM one. For your API keys: rotate them, know which agent has which key, put caps and email alerts on all of them, and please, use a password manager. Wolfram put it well, treat API keys like a credit card, except worse, because your card at least has a CVC and 2FA. Nisten’s setup is worth stealing: every morning at 6am an Opus prompt checks every pip, npm and Linux package on his machines against the latest security news and sends him a report. And if you’re freaking out on X, remember the algorithm loves fear and will keep feeding it to you. The big companies patched, the sky isn’t falling, so go touch some grass and then do your security homework. 1Password for Agents (X, Blog)  Some good news to end on, breaking during the show (thanks Peter!): 1Password launched a platform for agents. When your agent hits a sign-in form, it requests a credential, you approve, and 1Password fills it in directly, so the agent logs in without ever seeing your password. It’s basically Stripe Link for passwords, and since 1Password has been the most reliable tool in my life for 15 years, I joined the waitlist right away. Big Companies & APIs Anthropic commits 5% of its shares to a Public Benefit Fund (X, Blog) {% embed youtube.com %}  Anthropic put 5% of its shares into a new Public Benefit Fund, and together with the founders pledging 80% of their equity and employee matching, they say roughly 20% of the company is now earmarked for the public good, ahead of what’s expected to be a huge IPO. (LDJ corrected me on the show, Anthropic has been a PBC since before ChatGPT existed, what’s new is this specific fund.) Dario also wrote a very long reply to Nathan Calvin’s critique, and the bit that stuck with me is that they held Mythos-class models from February until June, when the cyber safeguards were ready. OpenAI - 12-hour prompt caching, and a Codex cache that never expires (X, Tibo)  OpenAI shipped the most boring features this week, but maybe the most useful ones. 12-hour prompt caching is now in the API, pitched at always-on agents like Dots that reuse the same tools all day. The bigger piece came from Tibo on the Codex team: in Codex, the cache for logged-in users now never expires, so you can come back to a thread from last week and still hit it. In Claude Code, coming back to a long thread means paying for all those tokens from scratch. Storing all that can’t be cheap (LDJ’s theory: “Hey Astra, design a new SSD”). Also, GPT-6 Astra Pro in ChatGPT now runs multiple agents on parts of your task in parallel. I’ve been pretty disappointed in Astra (it just stops all the time), but Astra Pro is basically many big models in a trench coat, so I’m curious. Gemini 4 Argon, one week in (Logan, Paper)  Logan says Argon processed about 25 trillion tokens in its first 72 hours, and Sundar said Google is compute constrained. Google! The coolest Argon story this week (ok, Claude picked it as my favorite, let’s call things like they are 😂) is four Argon agents beating Minecraft from scratch in 27 hours with no human help, dying 605 times along the way... on easy mode. Open Source AI DeepSeek V4.1-Flash-1017 - better and cheaper, still MIT (X, HF) {% embed youtube.com %}  The whale has resurfaced! DeepSeek shipped yet another checkpoint of V4.1 Flash (1017, what a mouthful), still MIT licensed. Terminal-Bench 4.0 jumps from 31.2 to 42.3 and the outputs got shorter, so it’s both better and cheaper to run. LDJ thinks it’s better than the previous checkpoint but not threatening the Fables and Astras (and he really wishes they’d just call it V4.2). Where it absolutely crushes it though is cost per task. DeepSeek is alone in the top left of this chart, and you can only pull that off with a very, very good inference stack. Which brings me to...  DeepInfer - DeepSeek open sourced the engine it actually runs on (X, GitHub)  DeepSeek open sourced DeepInfer, the inference engine that serves V4.1 Flash in production, under Apache 2, running on both NVIDIA Blackwells and Huawei’s Ascend 950. Tim Dettmers (the QLoRA guy) says it’s on par with OpenAI’s production stack, and better than what Anthropic runs, at least at their user size. Yam joined just in time (”Bro, they broke the internet”) and explained why this is a big deal: serving is every inference provider’s bread and butter, and the more users you serve on the same hardware, the more margin you keep, “you literally print money”. Our folks at CoreWeave are already comparing it with vLLM, and I expect prices to come down everywhere because of this. Flint - a local coding model designed by the Eureka Machine (X, Blog, HF) {% embed youtube.com %}  Western open source! Recursive (Richard Socher’s new lab) released Flint, a 39.8B MoE with only 2.5B active, Apache 2, built to run fast for coding on your Mac. Nisten ran agents on it all day and calls it underhyped: tiny, but extremely fast. Tim Shi from Recursive joined us (first time on the pod!), and the most interesting part isn’t the model, it’s how they made it. Flint is the first demo of their Eureka Machine, a system of agents that propose, implement and validate ideas in a loop. They asked it for the best architecture for speed plus coding on a MacBook, and it came back with something way sparser than comparable models. My favorite detail: every human researcher will tell you never to quantize the LM head to 4 bits, the Eureka Machine tried it anyway, and it turned out to be a good idea. And they went from zero pre-training effort to a released model in under 4 months! Prince Canuma, our MLX king, had day zero support and now ranks Flint in his top 3 local coding models, with up to 8 agents in parallel hitting nearly 500 tokens per second on an M5 Max. After this week’s security mess, an agent that never leaves your machine is starting to look like a feature.  Jensen closes GTC Berlin with Hermes Agent (X)  “The way you build an agent, is you ask an agent to build it for you” - Jensen Huang GTC Berlin is full of red claws, but Jensen closed his keynote with Hermes Agent from Nous Research! He set up a custom Hermes in one prompt and had it train MicroDuck robots in simulation until four real ones walked around on stage. Fun fact: MicroDucks come from Pollen Robotics, which Hugging Face bought, and Hugging Face is now part of NVIDIA 😂 --- From the Forge, powered by CoreWeave (Forge) {% embed youtube.com %} After 3.5 years, This Week’s Buzz is retired, and our sponsor corner is now From the Forge, powered by CoreWeave (with a brand new intro made with MiniMax H3 Max and an ElevenLabs jingle, I need to get used to saying it!). Wolfram was at our booth at GTC Berlin and showed us the new NVIDIA HGX Rubin NVL8 sitting right there on the desk, a $1.2M box, coming to CoreWeave this quarter with NVIDIA projecting 10x more tokens per megawatt than HGX B200. And Reflection’s Beam (501B, Apache 2) is running on CoreWeave Serverless Inference from day zero, after being trained with Weights & Biases inside Forge (”we knew Beam back when it was just a loss curve”). Forge is free to start, go check it out. --- Vision & Video Kling 4.0 - 30 seconds of 4K video in a single pass (X, Release notes)  We’re now in the era of 30 seconds of 4K video with stereo audio, in one pass. We played the demos live and the lip sync is genuinely great, though the rap one was very clearly AI generated. Peter says Kling 3 sits around 19th on Arena, so a strong Kling 4 adds another top tier competitor, and the race now is realism and speed. On speed, Black Forest Labs and our friends at fal launched FLUX 3 Max (X), a 10-second clip in about 12 seconds, so not quite real time but close. And Wolfram is running MiniMax H3 locally on his 3090, which he calls “almost frontier, I would call it frontier”.  Wrapping up There’s a reason it took the big labs 8 or 9 months after OpenClaw to ship their own personal agents, and after a week like this one, I get why they took their time. So, patch your PHP and Node, update your browser and OS, wait 24 hours on new packages, cap and rotate your API keys, and use a password manager. Huge thanks to Josh, Tim, Prince, Wolfram, LDJ, Nisten, Yam and Peter. Next week, my full Claude Duet review. See you next week! TL;DR and show notes - Hosts and Guests - Alex Volkov - AI Evangelist, CoreWeave (@altryne) - Co-hosts: @WolframRvnwlf, @ldjconfirmed, @nisten, @yampeleg, @petergostev - Tim Shi - co-founder, Recursive (@Recursive_SI) - Prince Canuma - Nativ, mlx-vlm (@Prince_Canuma) - Josh Long - security expert (@theJoshMeister) - Big CO LLMs + APIs - Anthropic commits 5% of its shares to a Public Benefit Fund, ~20% of the company now earmarked for the public good (X, Blog) - Dario Amodei answers Nathan Calvin’s critique (Dario, Calvin) - Claude Duet: a proactive Opus 5.5 agent, research preview waitlist for US Pro and Max (X, Product, Blog) - OpenAI 12-hour prompt caching; Codex and Work cache never expires (X, Tibo, Docs) - GPT-6 Astra Pro runs parallel agents in ChatGPT (X) - OpenAI models come to Google Cloud Model Garden, private preview (X, Blog) - OpenAI acquires Orchestra Bio; free Rosalind plan for university labs (Blog, Blog) - Aleksander Madry returns to OpenAI to work on safety and security (X) - Gemini 4 Argon: ~25T tokens in 72 hours, four Argon agents beat Minecraft in 27 hours, now in Antigravity for Pro (X, X, Paper, Blog) - Inception Mercury 3: diffusion LLM, 1,000+ tok/s, 1M context (vendor numbers) (X) - Security week (Black October) - PHP2Shell: two critical PHP engine RCEs (CVSS 9.2); upgrade to 8.5.12, 8.4.27, 8.3.36 or 8.2.35 (Wiz, OpenAI, Blog, Calif, CISA, Checker) - eMudhra root TLS certificates had a trivial private key; update your browser and OS (X, Cloudflare) - OpenAI Daybreak credited with a run of big finds, from PHP2Shell to a Chrome full chain (X, Infosecurity) - Railway: attacker accessed customer environment variables, some decrypted; roll all keys (Blog, Status) - OpenCode Console breach exposed stored provider keys for 1.4% of Console users (StepSecurity) - LiteLLM 1.107.0 backdoored on PyPI and Docker with a credential stealer; pin 1.106.2 and rotate keys (Wiz, StepSecurity) - Microsoft: Storm-0940 used the agentic AI pentest framework ARTEX against hundreds of orgs (X, Blog) - Eito Miyamura’s practical security checklist (X) - 1Password for Agents: agents use your logins without seeing your passwords (X, Blog) - Open Source LLMs - DeepSeek V4.1-Flash-1017 (MIT): Terminal-Bench 4.0 31.2 to 42.3; Search and Fetch APIs open to all (X, HF) - DeepSeek open-sources DeepInfer, its production inference engine (Apache 2.0) (X, GitHub, Tim Dettmers) - MiniMax M3.1 Flash is Space Bunny: $0.15 / $0.60 per 1M tokens, weights due Oct 23 (X) - Recursive Flint: 39.8B total, 2.5B active local coding model (Apache 2.0) (X, Blog, HF, Nativ) - vLLM Semantic Router Decision 3.0 (D3) decider models (HF) - Agents & Tools - Jensen closes GTC Berlin with Hermes Agent training HF’s Microduck in sim (X) - NVIDIA OpenShell Reference Architecture: boundaries for agents (X) - From the Forge, powered by CoreWeave - Reflection’s Beam full weights on CoreWeave Serverless Inference; CoreWeave says Reflection used W&B in Forge during training (X, Blog) - RL Rollouts: NVIDIA and you.com post-train Nemotron 3.5 Lightning, BrowseComp 37% to 45% (X) - Physical AI Launchables: one-command robotics templates (X) - NVIDIA HGX Rubin NVL8 comes to CoreWeave Cloud this quarter (X) - CoreWeave Zero Trust AI Framework (X) - NVIDIA DSX POD: pre-tested AI factories in as little as 14 days (X) - Forge: free to start, 30-day Pro trial (Forge) - Vision & Video - Kling 4.0: up to 30s in one pass, 10 keyframes, 15 references, API rolling out (X, Release notes) - FLUX 3 Max (BFL + fal): a 10-second clip in ~12 seconds (X, X, fal) - MiniMax H3, open weights, running locally on a 3090 (HF) - Odyssey puts a simulated FlyWire fruit fly brain inside the Odyssey-3 world model (X) - AI Art & Diffusion - Krea 3 Ultra: #4 on Arena multi-image edit, behind only OpenAI (X, Blog) - Voice & Audio - ElevenLabs Eleven Realtime: 0.57s to first audio, OpenAI Realtime-compatible API (X, Blog) - Mistral Voxtral 3: transcription, TTS and a voice agent API (X, Blog) - Underdog Bark 3.0: 163 MB open speech-to-text that ties NVIDIA Parakeet (CC-BY 4.0) (X, HF)

Catch the php2shell vulnerability instantly ⚡ ⭐ GitHub Repository: openai/php2shell-checker In this video, we explore php2shell-checker, an open-source project that scans local PHP binaries or remote URLs to detect vulnerability to php2shell using JavaScript.. #github #coding #opensource #programming #developer

How AI-Assisted Vulnerability Research Becomes a Patch, Not Just a Finding Billing Support — October 22, 2026 Finding a vulnerability is not the same as securing users. Once AI accelerates discovery, the hard part shifts downstream: reproducing reports, rejecting false positives, designing compatible fixes, coordinating releases, and confirming that deployed systems are actually protected. OpenAI’s October 21–22, 2026 PHP2Shell disclosure illustrates why vulnerability research needs an operational pipeline, not merely a capable model. Discovery Must Start With a Bounded Task A useful AI-assisted security engagement begins by constraining the problem. Researchers and maintainers define the codebase, components, threat assumptions, supported versions, and classes of behavior worth investigating. Without those boundaries, a model can produce a large queue of speculative findings that consumes more maintainer time than it saves. OpenAI’s Patch the Planet program was designed around this bottleneck. The initiative combines frontier models with human security review across discovery, validation, severity assessment, patch development, testing, and disclosure. Maintainers remain responsible for accepting and deploying upstream changes. Within a bounded investigation, AI can help researchers perform variant analysis: starting from a known weakness or dangerous pattern and searching for related implementations elsewhere in the code. It can also assist with building fuzzing harnesses that repeatedly feed structured, malformed, or boundary-case inputs into a target component. Harness creation matters because a finding becomes more credible when it can be triggered consistently. The harness also becomes reusable infrastructure. Maintainers can run it against later commits rather than relying on a one-time model transcript or a prose description of suspicious code. Trail of Bits, which collaborated on the program, describes its role in the defensive workflow on its Patch the Planet program page. The important distinction is that the AI supports researchers performing these tasks. It does not independently decide that a report is valid, merge a change, publish a release, or operate production systems. Humans Turn Candidate Findings Into Engineering Evidence After discovery, human security engineers must reproduce the behavior in a controlled environment. They inspect the relevant execution path, establish the conditions required to reach it, and determine whether the result crosses a meaningful security boundary. This triage stage separates four questions that automated output can blur: - Is the reported behavior reproducible? - Is it a security issue rather than an ordinary software defect? - Which versions, configurations, and interfaces are affected? - Can the report be communicated without exposing unnecessary exploitation detail? A model-generated candidate may be wrong because it misunderstood data flow, assumed an unsupported configuration, or overlooked an existing validation layer. Manual reproduction limits the cost of sending maintainers low-confidence reports and gives patch authors a concrete failing case. PHP2Shell is the current illustrative disclosure, not evidence that every model-generated report deserves emergency treatment. OpenAI’s account of the coordinated disclosure of critical vulnerabilities presents the response as a multi-stage process involving validation, fixes, staged communication, update deployment, and public guidance. The lifecycle is compact in concept, but each transition requires evidence and an accountable owner: Bound scope -> AI-assisted search -> Human reproduction -> Triage -> Patch -> Regression/differential tests -> Maintainer review -> Coordinated release -> Verify deployment When discovery accelerates, this chain becomes the limiting factor. More findings increase demand on the same scarce resources: security engineers who can validate them, maintainers who understand compatibility constraints, release teams that can package fixes, and operators who must deploy them. Faster scanning without greater remediation capacity can therefore create a larger backlog of known but unresolved risk. A Patch Needs More Than a Plausible Code Edit Once engineers confirm a vulnerability, AI can assist with proposing edits, tracing callers, identifying similar branches, and generating tests. But a plausible diff is only the beginning. The patch must first stop the reproduced behavior. It must then survive regression testing, which checks that existing supported behavior still works. Security fixes often touch parsers, validation rules, protocol handling, or compatibility paths where an apparently narrow change can reject legitimate inputs or alter output. Differential testing adds another layer. Researchers run related inputs against the vulnerable and patched versions, then compare results. The expected difference should appear for the malicious or invalid case, while normal cases should remain stable. This technique helps detect both incomplete fixes and overly broad restrictions. Variant analysis should also be repeated after the initial patch. If the vulnerable pattern exists in parallel code paths, fixing only the first reproducer may leave equivalent routes open. The original fuzzing harness and newly added regression cases should be retained so future changes cannot quietly restore the defect. Upstream maintainer review remains essential. Maintainers understand release branches, portability requirements, API guarantees, and project-specific conventions that an external research team may not. They may revise the proposed patch, request a narrower change, or choose separate fixes for different maintained branches. That is normal review, not friction to be bypassed. Disclosure Ends With Verification, Not Publication For a serious vulnerability, publishing immediately after validation can leave downstream users exposed before fixes reach them. Coordinated disclosure instead stages the work: validate the issue, prepare and test patches, notify relevant parties, support update availability, and then provide public guidance. Developers should treat the release as an operational event. Subscribe to authoritative project channels, map fixed releases to deployed versions, prioritize externally reachable systems, and preserve evidence that updates completed. For PHP, the official PHP announcement stream gives maintainers and operators a primary channel to check alongside their package or platform provider. Verification should test the deployed environment, not merely confirm that a ticket was closed. OpenAI published a PHP2Shell checker to support that final step. Teams should still review what any checker tests, run it within appropriate authorization boundaries, and record the version, configuration, and result. Maintainers can prepare before the next disclosure by keeping supported-version inventories, reproducible test environments, fuzz targets, private reporting channels, release checklists, and named owners for security decisions. They should also define who can approve patches, who coordinates downstream notification, and how production teams prove rollout completion. The takeaway: AI can shorten vulnerability discovery and assist with analysis, harnesses, patches, and tests, but security improves only when humans operate the full path from bounded investigation through upstream review, coordinated release, and verified deployment.

How to Check Your Servers for PHP2Shell (CVE-2026-109618) ! Status as of October 22, 2026. Exploitation in the wild has been reported. Check your servers first, read the theory later. Introduction Two critical bugs in PHP itself, called PHP2Shell, were fixed on October 21, 2026. They can let an unauthenticated web request run code on your server. The bug is in the PHP engine, not in your app. So you can have clean code, fresh plugins, and still be exposed. This is a how to guide. By the end you will be able to: Find every PHP runtime you own. Read the version that really serves traffic, not just what php -v prints. Tell a real patch from a distro backport. Catch the classic "package updated but workers never restarted" trap. Search your logs and files for signs of attack. Apply interim settings if you truly cannot patch today. What is PHP2Shell? PHP2Shell is the nickname for two PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619. The PHP security team rates both 9.2 on CVSS v4.0. Both can allow remote code execution without logging in. CVE Short name What goes wrong CVE-2026-109618 OOM corruption When PHP runs out of memory in the middle of a request, cleanup can treat half built data as valid CVE-2026-109619 Stale global state State from one request survives after its memory is freed, and a later request on the same worker uses it Tenable's FAQ also says the second bug can leak memory. That memory can hold passwords, tokens and keys. Why should developers care right now? Three reasons. It hits everything that serves web requests. PHP says this includes PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. The risk is highest on mod_php, where one demonstrated exploit fires before your application code even starts (Tenable). Your app code does not matter. Wiz showed code execution against current WordPress, Drupal and Joomla container images, and said it does not depend on a bug in the app (Prophet Security). Attacks started before the patch. Amazon Threat Intelligence saw an attempt on October 17, four days before disclosure (Tenable). Which PHP versions are affected and what is the fixed version? Short answer: any PHP that serves web requests and is older than the fixed release of its branch. PHP branch Fixed in Notes 8.5 8.5.12 Official release 8.4 8.4.27 Official release 8.3 8.3.36 Official release 8.2 8.2.35 Official release 7.4, 8.0, 8.1 No official release The PHP team published minimal source backports. Distros and LTS vendors may ship their own fix 5.4 to 7.3 None End of life. The earliest affected code path found by Calif goes back to 5.4.0 Source: Tenable and the PHP 8.5.12 release note, which states plainly that there is no complete mitigation and updating is the only safe choice. About numbers: an early leak of the CVE IDs came with a CVSS score of 10.0. The PHP Foundation says that was wrong and the real score is 9.2. Trust the PHP team's number. How do I check if my server is vulnerable? Follow the flow below. Each step has commands in the next sections. Step 1: Find every PHP runtime you own The scary hosts are the ones you forgot. Malwarebytes warns about abandoned sites, old apps and devices with PHP based admin panels. Make a list of: Production, staging and old VMs. Docker images and Kubernetes workloads. Official wordpress and drupal images bundle PHP, so the image name will not always say "php". Shared hosting and managed platforms (ask the provider). Vendor appliances with a web admin page. On a Linux host, this finds what is installed: which -a php ls /usr/bin/php* /usr/sbin/php-fpm* 2>/dev/null dpkg -l 'php*' 2>/dev/null | grep '^ii' # Debian, Ubuntu rpm -qa 'php*' 2>/dev/null # RHEL family For Docker, list the PHP version inside every running container: for c in $(docker ps -q); do echo "== $(docker inspect -f '{{.Name}}' "$c")" docker exec "$c" php -v 2>/dev/null | head -n1 done For Kubernetes, list images first, then exec into the suspicious ones: kubectl get pods -A -o jsonpath='{range .items[]}{.metadata.namespace}{"\t"}{.metadata.name}{"\t"}{.spec.containers[].image}{"\n"}{end}' | grep -iE 'php|wordpress|drupal|joomla|nextcloud' Step 2: Read the version that really serves traffic php -v is the CLI. Your site might run a different PHP through FPM or Apache. The OpenAI checker skill says the same: start with php -v, then verify it matches the site's PHP-FPM or Apache installation. Ask each piece directly: php -v | head -n1 # CLI php-fpm8.3 -v | head -n1 # PHP-FPM (name differs: php-fpm, php-fpm8.3 ...) apachectl -M 2>/dev/null | grep -i php # is mod_php loaded? If you want the truth from the web side, use a temporary probe file. It only prints the version and two settings. Use a random name and delete it right away. TOKEN=$(openssl rand -hex 12) sudo tee "/var/www/html/_p_${TOKEN}.php" >/dev/null <<'PHP' <?php header('Content-Type: text/plain'); echo PHP_VERSION, ' ', PHP_SAPI, "\n"; echo 'memory_limit=', ini_get('memory_limit'), "\n"; echo 'upload_progress=', ini_get('session.upload_progress.enabled') ?: '0', "\n"; PHP curl -s "127.0.0.1" sudo rm -f "/var/www/html/_p_${TOKEN}.php" Adjust the web root and host header for your vhost. If you run WordPress, Site Health under Tools also shows the PHP version the web server uses. Checking a site from outside is possible but weak. The OpenAI checker can read the version from HTTP headers: node phpcheck.js "example.com" node phpcheck.js --local node phpcheck.js --local --json Its exit codes are 0 for OK, 1 for VULNERABLE, 3 for UNKNOWN, and 2 for bad arguments. It only sees versions exposed in headers or from php -v, so a hidden header gives you UNKNOWN. Good practice anyway, but it means this method cannot clear you. Step 3: Compare the version with the fixed release Here is a small script. The table of last vulnerable versions per branch comes from the OpenAI checker (as of October 20, 2026). #!/usr/bin/env bash php2shell-version-check.sh Usage: ./php2shell-version-check.sh # uses the CLI php ./php2shell-version-check.sh 8.3.6 # check a version string ./php2shell-version-check.sh "$(php-fpm8.3 -v | head -n1 | awk '{print $2}')" set -euo pipefail RAW="${1:-$(php -r 'echo PHP_VERSION;')}" VERSION="${RAW%%[-+~]*}" # strip distro suffix like -0ubuntu0.24.04.10 BRANCH="${VERSION%.*}" # 8.3.6 -> 8.3 declare -A LAST_VULN=( [5.4]=5.4.45 [5.5]=5.5.38 [5.6]=5.6.40 [7.0]=7.0.33 [7.1]=7.1.33 [7.2]=7.2.34 [7.3]=7.3.33 [7.4]=7.4.33 [8.0]=8.0.30 [8.1]=8.1.34 [8.2]=8.2.34 [8.3]=8.3.35 [8.4]=8.4.26 [8.5]=8.5.11 ) LAST="${LAST_VULN[$BRANCH]:-}" if [[ -z "$LAST" ]]; then echo "UNKNOWN PHP $RAW (branch $BRANCH is not in the table)" exit 3 fi OLDEST="$(printf '%s\n%s\n' "$VERSION" "$LAST" | sort -V | head -n1)" if [[ "$OLDEST" == "$VERSION" ]]; then echo "VULNERABLE by upstream version PHP $RAW (last vulnerable in $BRANCH: $LAST)" echo "Distro package? Check the vendor changelog before you panic (step 4)." exit 1 fi echo "OK PHP $RAW is newer than $LAST" A version number can lie in both directions, and this is the part most people miss. Distro packages often carry the fix under the old upstream number. An Ubuntu build that says 8.3.6 may already be patched. That is why the script says "by upstream version". A Dockerfile that pins a full tag such as php:8.4.26-apache stays vulnerable until you change the tag. Sevalla's advisory notes that moving tags like php:8.4-apache already point to patched images. Step 4: Prove a distro package has the fix Look for the CVE ID in the package changelog. Debian, Ubuntu apt changelog php8.3-fpm 2>/dev/null | grep -m5 -i 'CVE-2026-10961[89]' zcat /usr/share/doc/php8.3-common/changelog.Debian.gz 2>/dev/null | grep -m5 -i 'CVE-2026-10961[89]' RHEL family rpm -q --changelog php-fpm | grep -m5 -i 'CVE-2026-10961[89]' No match does not prove you are exposed. Not every vendor writes the CVE ID in the changelog. If you find nothing, open your vendor's security tracker for the CVE. Newsweek reports that Ubuntu shipped fixes for supported releases, including older ones under extended maintenance, but I did not verify exact package numbers, so I will not list them here. Step 5: Check that the running workers actually restarted This is the trap. After apt upgrade, the new files are on disk, but a long running PHP-FPM or Apache process keeps the old code in memory until it restarts. Prophet Security says to compare each worker's start time with the package install time (source). On Debian and Ubuntu, the easy way: sudo needrestart -r l A manual check that works anywhere (run as root): #!/usr/bin/env bash stale-php-workers.sh ps -eo pid=,comm= | awk '$2 ~ /^(php-fpm|php-cgi|lsphp|frankenphp|apache2|httpd)/ {print $1}' | while read -r pid; do exe="$(readlink "/proc/$pid/exe" 2>/dev/null || true)" lib="$(grep -E '.so[^ ]* (deleted)' "/proc/$pid/maps" 2>/dev/null | grep -Ei 'php|apache|httpd' | head -n1 || true)" if [[ "$exe" == "(deleted)" || -n "$lib" ]]; then echo "STALE pid=$pid exe=$exe" fi done Any STALE line means that process still runs replaced files. Restart it: sudo systemctl restart php8.3-fpm # PHP-FPM sudo systemctl restart apache2 # mod_php (httpd on RHEL family) Step 6: Check the config routes that make exposure worse Prophet describes two config patterns that matter for CVE-2026-109619: On mod_php, php_value and php_flag in .htaccess or directory config, because Apache applies them before the request starts. On PHP-FPM, setups where the web server passes PHP_VALUE or PHP_ADMIN_VALUE to the pool. Both are quick searches: sudo grep -rnE 'php_(admin_)?(value|flag)|PHP_(ADMIN_)?VALUE' \ /etc/apache2 /etc/httpd /etc/nginx /etc/php* 2>/dev/null sudo find /var/www -name .htaccess -exec grep -HnE 'php_(admin_)?(value|flag)' {} + Session upload progress is on by default and reachable even if your app never calls session_start() (Prophet). So do not assume "we do not use sessions" saves you. How do I patch? Update PHP itself. Updating WordPress, a theme or a plugin does not fix this (Malwarebytes and Automattic both say so). Where PHP runs What to do Verify Debian or Ubuntu sudo apt update && sudo apt install --only-upgrade 'php8.*', then restart FPM or Apache Steps 2, 4 and 5 RHEL family Upgrade all php* packages from your vendor, then restart Steps 2, 4 and 5 Docker Change pinned tags, then docker build --pull --no-cache and redeploy docker run --rm yourimage php -v PaaS Redeploy without build cache, and change pins in composer.json or FROM if you pinned an exact release php -v in the app terminal Shared hosting Ask the host to confirm the fix is installed, not just scheduled Ask for proof The apt command is the one used in the Pterodactyl panel security release. Upgrade every PHP package together so versions do not mix. Timing matters for containers. By Sevalla's update log, Docker Hub published patched official php images about three hours after the release, and some build systems got theirs the next morning. If you rebuilt early, your image may still be old. Check the result, not the build log. What if I cannot patch today? PHP says there is no complete mitigation. These settings only shrink the attack surface for specific paths (Tenable, Prophet). I could not open the PHP advisory page directly, so this list follows those two summaries of it. Setting Targets Side effect memory_limit = -1, set so apps cannot override it CVE-2026-109618 One request can eat all memory, so add a container or cgroup limit session.upload_progress.enabled = 0 CVE-2026-109619 Session based upload progress stops working fatal_error_backtraces = 0 (PHP 8.5 only) CVE-2026-109619 Fatal errors have no backtrace post_max_size = 8M (or 32M if you take uploads) CVE-2026-109618 Larger uploads fail pm.max_requests = 1 CVE-2026-109619 Each worker dies after one request, so it costs speed PHP-FPM pool example: ; /etc/php/8.3/fpm/pool.d/www.conf php_admin_value[memory_limit] = -1 php_admin_flag[session.upload_progress.enabled] = off ; PHP 8.5 only: ; php_admin_flag[fatal_error_backtraces] = off php_admin_value[post_max_size] = 8M pm.max_requests = 1 Apache mod_php, in the main or vhost config (not .htaccess): php_admin_value memory_limit -1 php_admin_flag session.upload_progress.enabled off Rules that PHP stresses: Set them in php.ini or the pool config. Do not use ini_set() or .user.ini. Restart every worker after the change. Cap memory with a container or cgroup limit. Do not use RLIMIT_AS or RLIMIT_DATA, because they can trigger the very allocation failure the bug needs. If an app takes no uploads, block multipart/form-data at the web server or proxy. Remember that php -i in a shell shows CLI values, not your FPM pool. Use the probe file from step 2 to see what the web side really has. Also remember that a WAF is a stopgap. Cloudflare says so about its own rules, and they only cover traffic that goes through Cloudflare. How do I check if someone already got in? Start your search at October 17, not October 20. Amazon saw the first attempt on the 17th and recommends investigating from at least that date (Tenable). Prophet suggests October 20, but the Amazon date is earlier, so use the earlier one. No public indicator list existed at the time of Prophet's write up, so these checks look for behavior. Check 1: Error logs Out of memory errors, crashes and timeouts that cluster around odd requests are leads. sudo zgrep -hE 'Allowed memory size of|Out of memory (allocated|exited on signal 11|Segmentation fault|Maximum execution time of' \ /var/log/nginx/error.log* /var/log/apache2/error.log* /var/log/php*-fpm.log* 2>/dev/null | head -n 200 Timestamps differ by log, so filter by eye or with these patterns: Log Timestamp looks like nginx error 2026/10/21 14:03:22 Apache error [Wed Oct 21 14:03:22.123456 2026] PHP-FPM [21-Oct-2026 14:03:22] A few memory errors from a known import job are normal. A cluster after requests from one outside address is not. Check 2: Odd POST requests Default access logs do not show content type. At least list which endpoints receive POST: sudo zcat -f /var/log/nginx/access.log* | awk '$6 == "\"POST" {print $7}' | sort | uniq -c | sort -rn | head -n 30 Anything that receives POST but never takes uploads deserves a look. To catch multipart uploads and chunked encoding from now on, extend your nginx log format: log_format php2shell '$remote_addr [$time_local] "$request" $status ' 'ct="$http_content_type" te="$http_transfer_encoding" cl="$http_content_length"'; access_log /var/log/nginx/access_php2shell.log php2shell; Prophet lists multipart requests to endpoints that never take uploads, and multipart sent chunked instead of with a length, as suspicious. Check 3: PHP workers that spawn shells Code runs as the worker account, so the next step of an attacker usually starts as a child of a PHP process. This shows live children: ps -eo pid=,ppid=,user:32=,comm= | awk ' { ppid[$1]=$2; usr[$1]=$3; comm[$1]=$4 } END { for (p in comm) if (comm[p] ~ /^(sh|bash|dash|curl|wget|python3?|perl|nc|ncat)$/ && comm[ppid[p]] ~ /^(php-fpm|php-cgi|lsphp|frankenphp|apache2|httpd)/) print "pid=" p, "user=" usr[p], "cmd=" comm[p], "parent=" comm[ppid[p]] }' This is only a snapshot. For history you need EDR or auditd. Expect some false alarms, because PHP mail() calls sendmail through /bin/sh. Compare with what the host did before October 20. Check 4: New files and new access PHP files changed since Oct 17 (compare with your deploy history) sudo find /var/www -type f -name '.php' -newermt '2026-10-17' \ -printf '%TY-%Tm-%Td %TH:%TM %u %p\n' | sort Script files inside upload folders (should be empty) sudo find /var/www -type f ( -path '/uploads/' -o -path '/upload/' ) -name '.ph' Persistence owned by the web user sudo ls -la /var/spool/cron/crontabs/ 2>/dev/null sudo crontab -l -u www-data 2>/dev/null sudo ls -la /var/www/.ssh 2>/dev/null WordPress: unexpected admins sudo -u www-data wp user list --role=administrator --fields=ID,user_login,user_registered --path=/var/www/html Sevalla gives the same advice for disks that survive a redeploy: look for .php files you did not add, such as in an uploads folder. If something shows up Treat the host as compromised until proven otherwise. Prophet's order, which I agree with: Save the web server, PHP and FPM logs before rotation deletes them. Rotate every credential the worker account could read, including database passwords in config files. Rebuild from a patched image. Do not clean the host in place. The memory leak part is why I would also rotate secrets on any host that was unpatched and internet facing when you cannot read its logs. This one is my own judgment, not a vendor rule. It costs less than guessing wrong. Best practices Keep an inventory of where PHP runs. This will not be the last PHP emergency. Verify with a command after every patch. Never trust "the pipeline is green". Restart after every PHP package update. Add needrestart or a scheduled restart check. Move PHP settings out of .htaccess and per request overrides into php.ini or the pool config. Plan an exit from end of life PHP. Branch 8.1 and older gets no routine fixes. Pin containers to a patch version in a build variable, not a forgotten FROM line. Common mistakes Mistake Why it happens Fix Only checking php -v The CLI and FPM can be different installs Check FPM, Apache and the probe file Updating CMS and plugins only The bug is in the engine Update PHP Package updated, no restart Old code stays in memory Run step 5 Marking a distro package "vulnerable" by number Backports keep old numbers Read the changelog Trusting a pinned Docker tag php:8.4.26-apache never moves Change the pin and rebuild Setting memory_limit=-1 with ini_set() Apps can override it Use php_admin_value or php.ini Starting log review on Oct 20 The public story starts there Start on Oct 17 Running a random PoC to "test" Looks quick and handy Don't. Tenable warns that unverified exploit code can carry malware, and the PHP team found no functional exploit in the early leaked ones Performance considerations memory_limit = -1 removes a safety belt. One bad request can eat the box, so set a container or cgroup limit. pm.max_requests = 1 kills a worker after every request. Opcache warms less, and latency goes up. Use it only as a short bridge. A restart drops in flight requests. Drain nodes in a load balancer and roll the update. Security considerations Assume exposure from October 17 for any unpatched internet facing host. A WAF is a stopgap. Cloudflare's own CTO said so. Site owners must know who patches PHP. Malwarebytes points out that on managed hosting, the host may need to apply the fix. Downtime does not mean a breach. Many sites went into maintenance mode on purpose, including government sites in Europe. For visitors, the practical advice stays normal: unique passwords, multifactor login, careful with surprise login or reset emails. Comparison: which check tells you what? Method Shows running version Shows patch status Misses php -v CLI only Upstream number FPM and Apache may differ php-fpm -v FPM binary Upstream number Stale workers still in memory Probe file on localhost Yes, the real SAPI Upstream number Needs web access and cleanup HTTP header checker Only if the header exists Upstream number Hidden headers give UNKNOWN Package changelog No Yes for distro builds Vendors that skip CVE IDs needrestart or /proc script No Shows stale processes Nothing about the version itself Vulnerability scanner Depends Yes Needs credentials for good results Use at least one version check, one patch proof, and one restart check. FAQ Is my WordPress site safe if I updated everything? Not by that alone. Updating WordPress and plugins does not touch the PHP engine. Automattic said sites hosted on WordPress.com, WordPress VIP, WP Cloud and Pressable were already protected. For anything else, ask whoever runs your server about PHP. Does PHP 8.1 or older get a fix? Not an official release. The PHP team published minimal source backports for 7.4, 8.0 and 8.1. Some Linux distributions and LTS vendors ship their own fixes. For 5.4 to 7.3 there is no fix from the project. Plan an upgrade to 8.2 or later. Is php -v enough? No. It reports the CLI. Check the version of the thing that serves web requests, and check that workers restarted. Do the interim settings make me safe? No. They block specific paths PHP described. PHP says updating is the only complete fix. Can I test my server with an exploit? Don't. Public code is unverified and may carry malware. Use version checks and the log hunt above. The OpenAI checker skill also says not to run exploit probes. How many sites are at risk? Rough numbers only. W3Techs reports PHP on 69.3% of sites whose server side language is known. That does not mean 69% are vulnerable. Researcher estimates mentioned by Tenable range from over 1.3 million to over 1.9 million internet exposed PHP hosts. Who found the bugs? The PHP Foundation credited Calif, OpenAI and Wiz, among others. Calif and Wiz both said they used AI models in their research, per Tenable. Newsweek also reports that Google Cloud described a Gemini model helping Wiz. I could not confirm that last detail in a second source, so treat it with care. Conclusion The job is simple, but it has four parts. Find every PHP runtime. Prove the fixed version runs, and restart the workers. Hunt for signs of attack back to October 17. Rebuild anything that looks hit. Next steps for today: Run the version script against every host and image. Patch, restart and verify. Do not stop at the package manager. Add the probe check and the needrestart check to your runbook. Put a date on retiring PHP 8.1 and older. References Tenable: php2shell FAQ Prophet Security: Detecting and investigating php2shell PHP 8.5.12 release (php-src on GitHub) PHP 8.4.27 release (php-src on GitHub) Sevalla: Protect PHP applications from CVE-2026-109618 and CVE-2026-109619 Sansec: PHP2Shell research JFrog Security Research: PHP2Shell

Топ-10 GitHub за 3 дня: Rubix-lang, flare-local-inference Обзор: топ-10 новых репозиториев GitHub за 19–22 октября 2026 — новые проекты GitHub и open source, которые быстрее всех набрали звёзды. В выпуске: tek-sys-hub/Rubix-lang — Язык .ix, компилятор которого целиком написан на ассемблере x86-64; NVIDIA/flare-local-inference — Локальный сервер вывода LLM для видеокарт NVIDIA SM120/SM121; openai/php2shell-checker — Проверяет сайт или локальный PHP на уязвимость php2shell. 1. tek-sys-hub/Rubix-lang — Язык .ix, компилятор которого целиком написан на ассемблере x86-64. (Assembly, +1895 ★) 2. NVIDIA/flare-local-inference — Локальный сервер вывода LLM для видеокарт NVIDIA SM120/SM121. (Python, +551 ★) 3. openai/php2shell-checker — Проверяет сайт или локаль��ый PHP на уязвимость php2shell. (JavaScript, +544 ★) 4. garycaogan/ai-live-avatar — AI-стример: цифровой человек Vidu S2 отвечает на сообщения чата. (Python, +318 ★) 5. nthnclrk/CleanFrame — Домашний экран для Samsung The Frame: приложения, фото и часы. (JavaScript, +278 ★) 6. Jakeschincariol/day-trader-skill — 11 навыков Claude для дейтрейдинга: сканер графиков, новости, входы и выходы. (Python, +267 ★) 7. kailashsr38/ascii-magic-art — 634 анимированных ASCII-рисунка для сайтов, README и терминала. (JavaScript, +256 ★) 8. lesnolie/Tigris — Лаунчер в стиле tvOS 26 для Android TV: стеклянный док и заставка. (Kotlin, +254 ★) 9. blendi-remade/prompt2rig — Текст описывает движение, персонаж Mixamo повторяет его в браузере. (JavaScript, +221 ★) 10. tombkeeper/BitKindle — Компилятор C для Windows x64, выросший из затравки в 3584 байта. (C, +189 ★) Источник: GitHub Search API, репозитории созданы с 2026-10-19, отсортированы по звёздам. Лидер: tek-sys-hub/Rubix-lang Остальные: NVIDIA/flare-local-inference, openai/php2shell-checker, garycaogan/ai-live-avatar, nthnclrk/CleanFrame, Jakeschincariol/day-trader-skill, kailashsr38/ascii-magic-art, lesnolie/Tigris, blendi-remade/prompt2rig, tombkeeper/BitKindle #GitHub #opensource #программирование Каждые 3 дня — 10 новых open-source проектов GitHub, быстрее всех набравших звёзды. Подписывайся, чтобы не пропустить следующий выпуск.

PHP2Shell: Two Critical PHP RCEs (CVSS 9.2) Leaked a Day Early — Check Your Version and Patch Today Two vulnerabilities in PHP itself — not in WordPress, not in a plugin, in the interpreter — give an unauthenticated attacker remote code execution on effectively every PHP release since 5.4. The details leaked on October 20, a day before the planned disclosure, and PHP shipped an emergency out-of-cycle fix on October 21. By the end of this article you will know whether your servers are exposed, exactly which versions fix it, and how to check for signs that someone got there first. One boundary up front: this is a defender's guide. It explains how the bugs work at the level you need to patch and hunt, links the primary sources, and contains no exploit code and no links to proof-of-concept repositories — including the fake ones, which are worse than useless (see the warning in Step 4). What happened: a disclosure that leaked a day early The flaws were found and reported to the PHP security team in August 2026, and were working through a normal coordinated disclosure with a planned reveal on October 22. The timeline then broke: - October 20, 2026: A Hacker News post and screenshots of a private exploit tool named "PHP2Shell" — credited to the researcher Calif — leaked the two CVE IDs and claimed the bugs hit every PHP release since 5.4.0. The post was taken down; the screenshots were already everywhere. - October 20, 19:33 UTC: PHP published an advance notice of an emergency security release and moved publication up a day, to October 21 at 14:00 UTC. watchTowr confirmed the leak was genuine and said it had reproduced both vulnerabilities. - October 21, 14:00 UTC: PHP released the fixes — 8.5.12, 8.4.27, 8.3.36 and 8.2.35 — with the full advisories: GHSA-w8hw-w9fx-j79w (CVE-2026-109618) and GHSA-6wmf-4rv5-p3rp (CVE-2026-109619). Both are rated CVSS v4.0 9.2 by the PHP security team. - The story is big enough that Wikimedia took its Phabricator instance offline as a precaution, and the pair already has a Wikipedia article. The discoverers credited across the reporting — Calif (Calif Research), Wiz, and OpenAI — and the role AI played in building the exploit chain are covered in the AI section below; Check Point's write-up is a good second source for the timeline. First, the bugs themselves. How the two bugs work, in plain language Some terms, defined once. RCE (remote code execution) means an attacker runs their own code on your server, with the permissions of the web server process. A SAPI is the layer that connects PHP to a web server — PHP-FPM, Apache's mod_php, php-cgi, FrankenPHP and LiteSpeed are all SAPIs, and all of them are in scope here. A worker is one long-lived PHP process inside those servers: it handles a request, cleans up, and handles the next one, thousands of times. That reuse is the heart of the second bug. CVE-2026-109618 — corruption through an out-of-memory crash. PHP sets a per-request memory limit. When a request runs out of memory mid-flight, PHP aborts it and runs cleanup. If the memory runs out at one specific moment — while PHP is still setting up the request's internal data structures — that data is only half-initialised, and the cleanup code can be made to treat the half-formed data as if it were valid. An attacker who can force memory exhaustion at the right instant (crafted multipart form submissions are one way to burn memory) corrupts the interpreter's own state, and from there reaches code execution. CVE-2026-109619 — stale state that outlives its request. Some internal state belongs to a single request and lives in memory the request owns. In this bug, that state can survive after its memory has been freed, and a global pointer still refers to it. When the next request lands on the same worker — remember, workers are reused — it can end up using the leftover state before normal initialisation resets it. This is the classic shape of a use-after-free: a program uses memory after giving it back, so whatever now occupies that memory is treated as something it is not. One confirmed path runs through Session Upload Progress, a default-on feature (session.upload_progress.enabled) that tracks file-upload progress in the session; PHP is explicit that other variants exist. <figure class="shot"> <img src="cortexflow.tech" alt="Isometric bench rig of CVE-2026-109619: one PHP worker drawn as a press, request 1's part left standing in the memory tray in orange, the freed tray hoisted away empty behind it, a pointer arm still aimed at the leftover part, and request 2 arriving on a rail carriage" loading="lazy" /> <figcaption>One PHP worker, drawn as a bench press with the Anatomy figure kit. Request 1 machined its part and left it standing in the memory tray — the orange block. Its tray was then freed and hoisted clear, empty, but the pointer arm never let go of the part. <strong>Notice:</strong> the press does not care that the part's owner is gone. When request 2 rides in on the carriage, the press works on whatever that pointer still finds — one request's leftover state, consumed by another request on the same worker. That is CVE-2026-109619, and it is also why restarting workers matters forensically: restart the press and the leftover part vanishes with the worker's memory.</figcaption> </figure> Two properties make the pair dangerous together. Neither needs a login, a valid session, or any application bug — Wiz demonstrated unauthenticated RCE against current WordPress, Drupal and Joomla images, and notes that even a "Hello World" script is enough surface. And on mod_php, PHP rates the risk highest: the attack can succeed before any application code runs, so application-level firewalls and plugin security tools may never see a request they can judge. Who is affected Every PHP release from 5.4.0 through the versions below is affected by at least one of the two flaws. Fixes exist only for supported branches: | PHP branch | Status | Fixed version (released Oct 21, 2026) | |---|---|---| | 8.5.x | Supported | 8.5.12 | | 8.4.x | Supported | 8.4.27 | | 8.3.x | Supported | 8.3.36 | | 8.2.x | Supported | 8.2.35 | | 8.1.x and older | End of life | No official PHP fix — upgrade branches, or apply a vendor/distro backport (the PHP team also published minimal source backports for 7.4, 8.0 and 8.1 for source builders) | SAPIs in scope: PHP-FPM, Apache mod_php (highest risk), php-cgi, FrankenPHP, LiteSpeed — in other words, if the PHP build serves web requests, it counts. CLI-only installs that never serve web traffic are not the concern; the forgotten PHP inside a container, a control panel, or a vendor appliance is. What to do now Step 1 - Find every PHP build you run Servers accumulate PHP: the distro package, a second version for one legacy app, copies inside Docker images, a control panel's private build. Inventory all of them before patching any of them: which -a php php-fpm php-cgi ls /usr/bin/php* /usr/sbin/php-fpm* /usr/local/bin/php* 2>/dev/null php -v docker ps --format '{{.Image}}' | sort -u which -a matters because it lists every PHP on the PATH, not just the default; the ls catches versioned binaries like php8.1 that nothing points to any more; and the Docker line reminds you that containers carry their own PHP that host patching never touches. Record the version of each build — that list is your patch checklist. Step 2 - Patch to the fixed version, then restart the service Install the fixed release for your branch from php.net or your distribution (distros and LTS vendors received the patches and several have shipped backports — check your vendor before assuming an old branch is stranded). Then the step people miss: sudo systemctl restart php8.3-fpm # adjust to your branch and SAPI # Apache mod_php instead: sudo systemctl restart apache2 php -v # confirm the fixed version number > Warning: Updating the PHP package on disk does not update the code already running. FPM and Apache workers are long-lived processes holding the old interpreter in memory; until you restart the service (or the workers recycle), you are still vulnerable — "patched" on disk, exploitable in production. Verify with php -v and by confirming the service actually restarted, and remember containers need rebuilt images, not package updates inside a running container. Step 3 - If you are on PHP 8.1 or older, make the EOL decision today There is no official fix coming for end-of-life branches. Your real options are: upgrade to 8.2+ (test first — most 8.1 code runs on 8.2/8.3 with few changes), apply your distribution or LTS vendor's backport, or build from source with the PHP team's minimal backports for 7.4/8.0/8.1. "Wait and see" is not on the list: Sansec publicly expected mass scanning within minutes of the fixed release, because a patch is also a map — diffing it shows attackers exactly where the bugs live. Step 4 - Hunt for compromise, evidence first Patching closes the door; it does not tell you whether someone already walked through it. Before you restart anything, read this warning — it changes the order of operations: > Warning: If you find pre-exploit indicators on an unpatched host, preserve the forensic state before patching and restarting. CVE-2026-109619 lives in worker memory, and restarting the workers destroys that state. Snapshot the machine or capture logs and process state first, then patch. Indicators defenders are hunting for (compiled from watchTowr, Check Point and Sansec reporting): - Multipart POSTs carrying a PHP_SESSION_UPLOAD_PROGRESS field, and large or malformed multipart POSTs generally - Repeated Allowed memory size exhausted fatals and request timeouts in PHP logs — the OOM bug leaves these behind - FPM/Apache worker segfaults or bursts of worker crashes and respawns - Unexpected files in the session save path, and new or modified .php files under web roots - Changes to auto_prepend_file / auto_append_file in any php.ini - Web server processes spawning sh, bash, curl, wget, nc or base64; new cron jobs, systemd units, users or authorized_keys entries Starter commands for the log and file checks: grep -h "PHP_SESSION_UPLOAD_PROGRESS" /var/log/nginx/access.log /var/log/apache2/access.log 2>/dev/null | tail -20 grep -hi "Allowed memory size" /var/log/php*.log 2>/dev/null | tail -20 find /var/www -name "*.php" -newermt "2026-10-19" -print 2>/dev/null grep -rn "auto_prepend_file\|auto_append_file" /etc/php/ --include="*.ini" 2>/dev/null Treat hits as triage, not verdicts: a .php file modified on October 20 might be your own deploy. What you are looking for is correlation — upload-progress probes plus memory fatals plus a new file is a very different picture than any one of them alone. Two defender tools help. OpenAI published a PHP2Shell checker on GitHub: two Codex skills — one checks a site by public URL, one runs on the server — that compare the detected PHP version against the fixed thresholds. It does not exploit anything; it is a version screen, and a site that hides its version header will come back "unknown." For hosts that cannot patch immediately, Syhunt's php2shell-protection toolkit collects emergency Apache mitigations (multipart blocking, request-size limits) — a stopgap with real breakage costs, not a fix. > Warning: Do not download or run "php2shell.py" proof-of-concept files circulating on GitHub. Per JFrog's reporting, fake PoC repositories from unknown accounts are distributing malware. You do not need an exploit to check your exposure — the version number is the check. And on workarounds, be clear-eyed: disabling session.upload_progress.enabled blocks at most one confirmed path of one bug, blocking multipart POSTs breaks every upload form you have and does nothing for the OOM bug, and the PHP core team's position is that patching is the only real mitigation. Cloudflare customers got WAF rules (its CTO said early attack attempts were observed before the patch shipped); everyone else has the checklist above. The AI angle: discovery and defence, compressed into the same week The reporting credits the discovery to Calif, Wiz and OpenAI, and both ReliaQuest and watchTowr describe frontier AI models compressing the exploit-development side of the work — turning a memory-corruption chain that would normally take a specialist far longer into roughly one week of work. Hold that number at arm's length (it comes from the firms reporting the incident, not from a published methodology), but the direction is hard to argue with: a pair of bugs this subtle — an OOM that has to land mid-initialisation, a stale pointer that needs a second request on the same worker — was found, chained and weaponised fast enough to force an emergency release for a language that runs a large share of the web. The same week produced the mirror image: OpenAI's checker is itself two AI skills, built to let any site owner ask "am I exposed?" in plain language. Offence got a tool; defence got a tool. What neither got is more time — the leak removed the one-day buffer the coordinated disclosure had planned, and the patch-to-mass-scanning window is now measured in minutes. The practical conclusion for anyone running infrastructure: your patch pipeline's speed is now a security control in its own right, because the other side's pipeline just got faster. What we don't know yet Honesty about the gaps, because they are real. The exploitation reports conflict: Cloudflare's CTO said early attack attempts were observed before the patch and that Cloudflare deployed WAF rules against them, while Huntress and watchTowr initially reported no observed exploitation. Both can be true (different vantage points, different definitions of "attempt"), and the picture will sharpen over the coming days. Version checkers are screening, not proof: they read a version number, which a backported distro package can make misleading in either direction. And the full technical root-cause write-ups were still landing as this article was published — if a detail here conflicts with the PHP advisories, the advisories win. Key Takeaways 1. PHP2Shell is two unauthenticated RCEs in PHP itself (CVE-2026-109618 via OOM corruption, CVE-2026-109619 via stale state), CVSS 9.2, affecting PHP 5.4 through 8.5 across FPM, mod_php, php-cgi, FrankenPHP and LiteSpeed. 2. Patch to 8.5.12, 8.4.27, 8.3.36 or 8.2.35 — and restart the service. An updated binary with un-restarted workers is still vulnerable. 3. PHP 8.1 and older get no official fix. Upgrade branches or apply a vendor backport; do not wait. 4. Hunt before you restart if you see indicators — multipart upload-progress probes, memory-exhaustion fatals, worker crashes, new .php files — because the stale-state evidence dies with the worker process. 5. There is no reliable workaround, and the circulating "PoC" files are malware bait. The version number is your test. Next step: run the Step 1 inventory on every host you own today, compare each version against the table, and schedule the restart in the same sitting — an inventory without a patch window is just a list of targets. --- *Originally published on CortexFlow. Free n8n templates: cortexflow.tech