If you are wondering whether your website is affected, we have packaged a Codex skill to help check. Point your Codex at this repo to guide you through it: github.com/openai/php2shell-…

Day 16/ You can now cache for 12h in the API and for logged in users across Codex & Work we keep cache forever and you don’t have any penalty for coming back to an old conversation or resuming after a few hours and are now guaranteed to hit the cache.

Teamwork makes the dream work. The team and I @J4ck3LSyN @Archknight23 🚨 Heads-up for anyone running PHP: two critical RCE bugs, patch drops tomorrow. The PHP project has confirmed an emergency security release for two critical remote code execution vulnerabilities: CVE-2026-109618 and CVE-2026-109619, both rated CVSS v4.0 9.2. 📅 Patch lands Wednesday, Oct 21 at 14:00 UTC (9:00 AM Central). PHP has reserved the right to ship it earlier if details leak or exploitation shows up. PHP runs about 75% of the web, including WordPress, Drupal, Joomla, Laravel, Magento, and countless custom apps. If you operate a PHP server, this is your weekend-ruiner unless you act. Here's the part the big threat-intel shops aren't shouting about: No official technical details are public yet. But based on my own source-code analysis of php-src, my best assessment (moderate confidence, NOT officially confirmed) is that the vulnerable path is PHP's session.upload_progress / multipart form-data (rfc1867) handling: 🔹 Present since PHP 5.4 🔹 Enabled by default (the compiled-in default is On; the sample php.ini ships it commented out, so stock installs have it live) 🔹 Processes uploaded request data before any of your application code runs, so it's reachable pre-authentication on a default config That lines up exactly with the public breadcrumbs: "affects default installs," "every version since 5.x," "fires before user code." Treat it as a working hypothesis, not gospel. The official advisory supersedes all of this when it lands. ✅ What to do right now: 1. Inventory your PHP. Know every host and version (php -v). Anything on PHP 7.x or older won't get a fix, so plan to upgrade. 2. Apply the stopgap (best-intel, low-risk, reversible). In php.ini / .user.ini / .htaccess: session.upload_progress.enabled = Off Reload PHP-FPM or your web server. My analysis says this closes one of the two likely paths. 3. Clamp multipart uploads at the edge. The second likely path lives in the multipart parser itself, which runs for any multipart/form-data POST regardless of the setting above. If you've got a WAF or reverse proxy, tighten inspection or rate-limit multipart POSTs to endpoints that don't need uploads. This is the same network-layer mitigation the enterprise vendors are quietly deploying for their paying customers. 4. Patch the second it drops. Current stable: 8.5.11 / 8.4.26 / 8.3.35 / 8.2.34. If your hosting is managed, confirm your provider's timeline today. Why I'm posting this for free: A pre-patch mitigation shouldn't be a subscription perk. I'm a one man shop, and the orgs most likely to get burned in the gap between leak and patch are the small teams without an enterprise threat intel contract. The steps above cost nothing. Spend tonight reducing risk, not tomorrow doing incident response. I'll follow up once the official advisory publishes and confirm whether my root cause read was right. Stay patched. 🔒 #PHP #CyberSecurity #InfoSec #RCE #CVE #WordPress #Laravel #ThreatIntel #VulnerabilityManagement #AppSec

You can now choose 12-hour prompt caching in the API. Persistent agents, like dots, reuse context throughout the day. You can keep shared instructions, tools, and context cached longer and pay the lower cached-input rate, even when requests are hours apart.

Generative UI is close to seeing its moment emerge – and I can't wait to show you all a new CF experience. Cloudflare's recent models make rendering near instant. Clef = Choose the best component Clairic = Populate props from image/text Rendering 5-10 components in ~1 second. Creating an amazing user experience has a lot of layers too it. It's not just about speed. Output needs to be exact. Styling needs to be consistent. Components need to be effortlessly composable. And none of that happens without an amazing context layer to glue it all together. It's more than just the models. And all of this can be complementary to any LLM output – not dependent upon it. Really excited with where things are at internally and when we can show more of what we're building to the world.

Seinfeld's reruns have made Jerry Seinfeld and Larry David hundreds of millions of dollars. Jason Alexander, who played George, says he has made less than $200,000 from them. That gap is part of why the show ended. In the video below, Alexander explains why George, Elaine and Kramer stopped wanting more seasons. In 1997, Seinfeld was the biggest comedy on TV. NBC offered Jerry $5 million an episode, about $110 million, for a tenth season. He said no. Every year before the Christmas break, Jerry asked his three co-stars if they wanted to keep going. In season 9, they all said it was done. Alexander, Julia Louis-Dreyfus and Michael Richards were not partners in syndication. The reruns would pay Jerry and Larry for life. Not them. "Seinfeld wasn't going to be the annuity for us that it was going to be for Jerry and Larry," Alexander says. Every new season tied them tighter to one character. "We were going to contribute to our own eventual demise as actors." The case for Jerry: he and Larry created the show and owned it. The cast signed their deals and were paid well, reportedly $600,000 an episode by the end. Before the final taping, the four of them held hands backstage like every week. They called it the circle of power. Jerry said: "For the rest of our lives, when anyone thinks of one of us, they will think of all four of us." Alexander says they walked out looking like they'd been hit by a truck. So should Jerry have shared the reruns with George, Elaine and Kramer?

just got the weekly status report from the team

I didn't think I'd find this useful, but the new "tab completion" feature in Codex is magical! It anticipates which step you'd likely take next, and then you can press tab to use it. The magic is, it's extremely good, almost like reading your thoughts! Well done @OpenAI 🫶

The NSA mathematician who made the numbers protecting your passkeys died in 2023 without ever remembering how he made them. Cryptographers chased the answer for years and put up a $36,864 bounty. Claude figured it out in under 30 minutes, and the answer was the clock on his computer. His name was Jerry Solinas. Back in 1997 he generated the starting numbers for P-256 and a few sibling curves, the math underneath your passkeys and a big chunk of the secure websites you visit every day. NIST published them in 2000 with no explanation of where they came from, and for a long time people mostly shrugged. Then 2013 happened. The Snowden files showed the NSA had slipped a backdoor into a different crypto standard, and suddenly every unexplained number the agency had ever handed out looked suspicious. These were the most widely used ones of all. Jerry's own story was that he'd hashed a joke sentence, something along the lines of "Give Bob and Jerry a raise," and then lost it when his work computer got swapped out. He tried to recreate it himself and never could. He even joked that any backup was probably sitting in the same warehouse as the Ark of the Covenant. After he died, Steve went digging. He tracked down former NSA people and old cryptographers, and four of them independently told him the same joke-phrase story. Filippo Valsorda turned that into a bounty in 2023, and for three years people threw computing power at every version of that sentence they could dream up. A few folks at Anthropic took a crack at it too, Steve among them. He's now one of the people credited on the solve. None of it matched. So someone at Anthropic tried something different. They asked an internal Claude model to figure out where the seeds came from and purposely left out the joke-sentence clue. Claude's first move was to think like a programmer in 1997. If you needed random numbers back then, you probably grabbed the basic generator that came with the C library on your Unix machine, and those old generators are simple enough that they leave fingerprints in their output. Sure enough, in four of the seeds the top bit of every 32-bit chunk was a zero. The odds of that happening by accident are about 1 in 5,810, and it's the calling card of a generator called lrand48. And this is where it gets fun. lrand48 runs in reverse just as easily as forward, so Claude rewound each seed back to the moment the generator was switched on. Every prime-curve seed rewound to a date and time from 1997 or 1998. Whoever ran the program had seeded it with the computer's clock. P-256's run started at 1:52:34 AM UTC on August 16, 1997. If that machine was at NSA headquarters in Maryland, somebody hit enter at 9:52 on a Friday night, and the seed that ended up in the standard was the 1,842nd one the program spat out. Jerry's joke sentence was never in there. He misremembered, four people faithfully repeated what he told them, and some very good cryptographers spent years trying to crack a hash of a sentence that nobody ever typed. Leaving the clue out is probably what let Claude get there in half an hour. I love the irony here. Using the clock to seed a weak random generator is one of the first things they tell you never to do in a security class. That exact laziness is why anyone can now rerun the NSA's 1997 program on a laptop and get the identical numbers, which makes it really hard to argue anything sneaky was hidden inside them. There's still one thing left to argue about. In the P-256 run, number 876 also would have made a perfectly good curve, and someone skipped it and kept going to 1,842. Anthropic says so few got skipped that it couldn't have been a hunt for a weak curve, but nobody knows why it happened. Claude's own notes from that moment are pretty funny. When the numbers matched, it actually stopped and wondered whether it was inside a test, since a 25-year-old mystery falling apart that fast seemed too good to be true. Then it reran the logic and talked itself into it, because ten curves each regenerating perfectly from a single timestamp doesn't happen by luck. The $36,864 is going to the nonprofit that runs Let's Encrypt, the group that gives free security certificates to millions of websites, a lot of them built on these same curves.

after an exciting week of launches (muse wonder [full] & muse spark open), i want to write a note of appreciation to the amazing research teams at meta superintelligence labs on reaching such a special milestone ♥️ we started MSL and TBD a little more than a year ago and set a goal of producing a frontier model within a year or so. given where llama4 landed, that was an incredibly audacious goal, and we knew it wouldn't be easy. many people told us it would be impossible. we knew it was unlikely, but still worth doing. a remarkable group of researchers and engineers joined the effort from inside and outside meta. every single person came in, picked up a shovel, and got to work with earnestness and urgency. nobody asked whose job it was. we assembled a team of the most brilliant people i have ever had the opportunity to work with (and remember, i was an HRT intern 🙃). i am surrounded by ambitious, visionary, technically excellent, hard-working, pragmatic, thoughtful scientists, engineers, and product folks—people who will chase a weird loss spike past midnight just because they need to know why. these models are the product of their passion, hard work, and brilliance. somewhat paradoxically, when we started TBD, we set a principle of no deadlines. we knew we had an astronomical amount of work ahead of us—across pretraining, post-training, RL, multimodal, infrastructure, safety, data, AND frontier research. there was no use setting arbitrary timelines—we just had to get to work, be thoughtful, and build the foundations of a frontier research effort in record time. and run after run, this team did exactly that. our researchers are magicians. i can only describe building these models with this team as a wondrous journey of scientific discovery. i am constantly amazed by what we can accomplish with scaling. i will remember this past year for the rest of my life—the late nights, the broken runs, the evals that came back better than any of us dared to hope. watching this team create wonder after wonder has been a true and deep gift. more than just the models we released this week, we have built a machine that builds new models. it often sounds like a cop-out to say labs can just turn the crank to keep scaling, but now i have seen it first-hand. sure, it's a lot of work and a careful process, but we have built a scalable system to keep advancing at the frontier, and i am really proud of how fast this team keeps making these models better. lastly, i get to work with researchers who care deeply about how their work benefits humanity. it's easy to forget when everything is changing so fast, but the whole damn point is to make people's lives better. time and time again, i have seen our researchers, engineers, and product folks build our technology with care so it can truly be good for the world—whether that's building the best models for muse, thoughtfully open-sourcing strong models, or making sure the alignment and security of our systems are rock solid. this is a team of people who never forget there's a real person on the other side of every prompt. thank you to everyone at MSL for being part of this crazy journey over the past year. i'm so grateful for every one of you, and our work is not done!

Day 11/ We've landed a series of changes and more compute to very significantly decrease the occurrence of the disruptive "Selected model is at capacity. Please try a different model". When it does happen, it should also eventually just continue by itself and not just block on it. Let us know if you still see it out there in the wild and we'll take a look.

muse spark open -- weights out today! best US open-source model, and runs on the new mac studio 🍎