AI progress — 22 October 2026

The most consequential item today is PHP2Shell: Wiz reports that AI uncovered a critical remote code execution flaw in PHP, and PHP shipped a security release on the same day. OpenAI also published a post on coordinating disclosure as agents find critical vulnerabilities. Anyone running PHP should check the release. Elsewhere it was a day of incremental model and tooling news.

New models and papers

• Recursive launches Flint — a coding model sized for laptops, which Recursive says was largely built by AI; weights are listed on Hugging Face. Why it matters: a local coding model is something you can try without an API account, though the claim about how it was built is the company’s own.
• Granite Speech 5.0 — IBM’s updated speech model for transcription, translation and speaker attribution. Why it matters: IBM presents it as more accurate and faster than the previous version; worth benchmarking if you run speech pipelines.
• VocabX: specializing small-model vocabularies — a write-up on tailoring the vocabulary of small language models to an application. Why it matters: the authors report a 77% cut in inference cost in real applications, a figure to verify on your own workload.

New tools and software

• Claude Duet — Anthropic’s new AI agent, which The Verge frames as a response to Meta’s Muse. Why it matters: it is a new agent product from a major lab; check the article for what it does before choosing it over existing options.
• OpenAI models coming to Google Cloud and Antigravity — OpenAI’s latest models will be available through Google Cloud and Antigravity. Why it matters: teams on Google Cloud can reach OpenAI models without a separate vendor relationship.
• GitHub CLI: expiring, auto-refreshing OAuth tokens — an opt-in to short-lived OAuth tokens that refresh automatically. Why it matters: CI and scripts using the CLI can stop relying on long-lived tokens.

Overall digest

• PHP2Shell: AI uncovers critical RCE in PHP — Wiz’s account of an AI-found remote code execution bug in PHP. Why it matters: it is a concrete case of AI-assisted vulnerability discovery landing in widely deployed software; patch accordingly.
• Meta to create a new class of shares to fund AI push — Meta announced a new share class alongside Q3 earnings to finance its AI spending. Why it matters: it changes how the company pays for its buildout, per The Verge’s report.
• Google staff resign over AI military contracts — the BBC reports resignations at Google in protest of its AI contracts with the military. Why it matters: it is one reported instance of employee dissent over defense work, not evidence of a wider trend.