AI That Finds Flaws: When Models Hack the Web for Real

PHP powers roughly seventy percent of websites worldwide, and yesterday cybersecurity firm Wiz revealed two critical core vulnerabilities uncovered not by human audit, but by frontier AI models. In episode 208, we looked at how enterprise capability claims often evaporate under scrutiny; this development cuts the other way. Wiz announced the flaws, dubbed PHP2Shell and tracked as CVE-2026-109618 and 109619, alongside patches developed with Google, OpenAI, and Amazon Web Services. The researchers deployed Google’s Gemini 4 Argon, OpenAI’s GPT-5.6 Sol, and their own Atlas system to locate deep memory-safety errors in PHP’s core engine and turn them into functional remote code exploits against platforms like WordPress and Drupal.

When reasoning models transition from generating boilerplate software to weaponizing obscure flaws in legacy web infrastructure, offensive automated research stops being a theoretical risk and becomes production reality. Moving from digital infrastructure to the physical world, Nvidia’s Jensen Huang announced expanded industrial partnerships across Europe on Wednesday, arguing that the continent’s manufacturing base gives it the actual edge in embodied robotics. French startup Pollen Robotics demonstrated duck-shaped, AI-trained machines built with Hugging Face, but the real enterprise signal came from Swedish freight operator Einride. Einride announced it is testing Nvidia’s vision-language-action reasoning model, named Alpamayo, directly inside its autonomous trucks.

Alpamayo is designed not just to perceive obstacles, but to interpret dynamic driving environments and explain the rationale behind driving maneuvers. Einride plans a live road rollout for the second half of 2027, but right now the model is running strictly in shadow mode, comparing its decisions in real time against human operators and existing systems without touching the steering. In robotics, stage demonstrations are cheap; live shadow-mode telemetry on commercial routes is the only metric that separates functional autonomy from marketing theater. On models and interfaces, ElevenLabs launched two speech-to-speech systems targeting automated voice workflows: Eleven Realtime v1 Mini and v1 Max, supporting ninety languages and over seventeen thousand voices.

Independent testing on the Big Bench Audio benchmark highlights the performance gap: the higher-tier Max achieved ninety-eight point eight percent reasoning accuracy and completed eighty-seven point one percent of tool-use tasks, compared to sixty point three percent for Mini. Max also shaved latency down to zero point five seven seconds. At the platform level, Meta confirmed yesterday that its standalone consumer agent app, Muse, reached ten million users across the United States and Canada in its first six weeks. Meta is issuing new non-voting shares to fund its aggressive chip and data center buildout, with chief financial officer Susan Li cautioning that meaningful incremental revenue won't arrive until 2027.

Note that our coverage here is general reporting and analysis, not investment advice. Every technology cycle generates plenty of noise around user growth and toy interfaces. The shift that matters is structural: models are moving out of sandboxed text windows and taking control of system vulnerabilities, voice execution, and heavy freight.