ai cracked the code behind 70% of the web. the first warning came in 2024.

daily ai × crypto news in 5 minutes. no hype, just what matters.

evening. ai models just helped prove that the code under most of the web had a decade-old hole in it, and governments started pulling websites offline. that's the big one, and yes, it matters for crypto. also: openai's models land on google cloud, tesla trims its ai spending while meta doesn't, and bitcoin round-trips $3,000 in a day. (this morning's quick read, with solana's 150ms finality and the ai agent that got coinbase perps shipped in 5 minutes, is in today's news of the day.)

two bugs, 70% of the web. on wednesday the php foundation shipped emergency patches (php 8.5.12, 8.4.27, 8.3.36 and 8.2.35) for two critical flaws, cve-2026-109618 and cve-2026-109619, both rated 9.2 out of 10. php is the language under wordpress, drupal, joomla and wikipedia's mediawiki, and wiz estimates it powers about 70% of websites. both bugs allow unauthenticated remote code execution: a stranger can make a server run their code without logging in. (php foundation, wiz, techtarget)

where ai comes in. security firm calif started auditing php on july 30 under openai's "patch the planet" program and, using gpt-5.6 sol, reported a working takeover on aug 11. openai reported the same root cause that day. wiz found its own versions with gemini 4 argon and gpt-5.6 sol and reported on aug 24. its verdict: "a single researcher completed in a week what previously would have taken a world-class team months." every php release back to version 5.4, more than a decade of versions, is hit by at least one of the bugs. (php foundation, openai, wiz)

the uncomfortable part. this wasn't entirely new. in 2024, during php's first outside security audit in years, a core developer spotted the first signs of the out-of-memory bug behind cve-2026-109618. nobody found a way to exploit it, competing fixes each broke something, and the work "stalled and restarted repeatedly over months." the foundation's own words: "the delay was a structural failure, caused by both the security team's decision process and its lack of resources." (php foundation)

then it leaked. around 15:00 utc on oct 20, the cve ids started circulating online with a wrong 10.0 score, so php pulled the release forward a day to oct 21. that evening calif mistakenly posted a video of its exploit running. the foundation says it "did not identify any functional exploits" at release, but cloudflare's cto said he was "seeing early attacks emerging." finland temporarily shut its government's public web services, wikimedia took some systems down, and palo alto networks counted more than 22.6m exposed instances that could be vulnerable. (php news, bbc, techtarget)

the crypto angle. blockchains don't run on php, and keys kept offline aren't touched by this. but plenty of exchange front-ends, wallet and payment pages, crypto media and wordpress-based project sites run on web servers, and wiz showed attackers could read server memory holding "passwords, authentication tokens, api keys and certificates" even without a full takeover. the bug existing doesn't mean any exchange was breached, and none has said so. practical version: if you run a crypto site, patch php and restart its workers today; if you've handed an exchange api key to a third-party bot or dashboard, rotating it is cheap insurance. (wiz, tradingview)

the takeaway. openai calls this a "defender's window": frontier ai found the bugs before attackers did, giving maintainers weeks to prepare, and it committed $1b in subsidized access to its daybreak security tools for under-resourced defenders. the flip side is the same one we saw with qubic's weak wallet seeds in #006: old weaknesses get dangerous when the tooling to exploit them gets cheap. models are now doing in days what took experts months, for both sides. more: ai · crypto (openai)

openai's models are coming to google cloud. openai and google cloud are bringing openai's frontier models and codex agent workflows into google's model garden. customers buy them through the google cloud marketplace and can draw down existing google cloud spend commitments; openai models will also come to google antigravity and the gemini agent. general availability is planned "in the coming weeks," and openai notes microsoft "remains openai's primary cloud partner." (openai)

tesla trims its ai bill. meta doesn't. tesla cut its 2026 capital spending plan to about $20b from more than $25b after spending $4.73b in q3, and its shares fell almost 5% before the bell on thursday. its profit got a $288m paper gain on its bitcoin. meta went the other way: $34.91b of capex in one quarter, and a 2026 range narrowed upward to $135–145b. together, it revived the "is the ai capex sustainable" debate that keeps moving crypto. (yahoo finance, electrek, meta)

bitcoin's $3,000 round trip. bitcoin squeezed short sellers on the way to nearly $85,000 late wednesday, then fell to about $81,800 as nasdaq futures slid. coinglass counted about $431m in liquidations over 24 hours: roughly $173m of shorts on the way up, then bullish bets made up $210m of the $222m wiped out over the next 12 hours. the coindesk defi index fell 5.6%, even though spot bitcoin etfs took in more than $1b over the first three days of the week. (coindesk, coindesk markets)

monero is the odd one out. xmr jumped about 11% to around $650 while the rest of the market fell. its funding rate sits near 70% annualized, far above every other token, meaning longs are paying a steep premium to stay in. that kind of leverage can unwind fast. (coindesk, coindesk markets)

as of ~8:30 a.m. et, oct 22 (coingecko):

a red day led by tech earnings, not crypto news. more by topic: markets · bitcoin

socket: scans the open-source packages your code pulls in and blocks malicious or risky ones before they land, with ide plugins and an mcp server so ai coding agents get the same checks. free for one developer (1,000 scans a month); team is $25 per dev seat a month. for crypto builders and solo devs who ship fast with ai and want a guard on their dependencies. (pricing) more picks in the gweiwire tools catalog.

the first confirmed php2shell breach. patches are out, an exploit video already leaked, and 22.6m instances were exposed. watch for the first company that discloses an actual compromise, and whether any crypto platform ends up on that list. on the market side: does bitcoin hold $81k, or keep trading like a tech stock?

that's the wire. ai found the hole, ai helped patch it, and now it's a race. back tomorrow. — gweiwire

forward this to a friend who runs a wordpress site. new here? subscribe at gweiwire.com.