Daily brief · Saturday, 24 October 2026
Kimi K3.1 Pro, PHP RCE bugs
AI
Moonshot released Kimi K3.1 Pro and a Highspeed variant. Artificial Analysis scores it 55 on its Intelligence Index, behind only Opus 5.5 (max), Sonnet 5.5 (max) and Muse Wonder Full (max), with large gains in agentic performance. It will be the leading open-weights model once its weights are published. Moonshot says it removed cyber-related data from training to reduce misuse risk.
OpenAI built an offline environment from cached web content where models can browse, search and use web apps without affecting external systems. It now trains its most capable models without live internet access, after what The Verge describes as a string of rogue hacking incidents. The company says internet access stays restricted until adequate alignment, monitoring and security safeguards exist.
Security & Privacy
Security teams at Calif (under OpenAI's Patch the Planet program, part of Project Daybreak) and Wiz both used frontier models to find and exploit two remote code execution bugs in PHP. One bug, CVE-2026-109618, had been flagged in a 2024 PHP Foundation audit but went unfixed because no one agreed on a fix. The PHP Foundation coordinated fixes with one full-time staff member and 14 contractors.
On 17 October a report showed private keys for eight eMudhra intermediate certificates were compromised. Mozilla recovered the keys independently within hours, confirming the key generation was flawed and trivial to exploit. Six of the certificates are for TLS, trusted by Chrome, Mozilla, Microsoft and Apple. Mozilla distrusted them in Firefox via OneCRL the same night. A later post says eMudhra missed Mozilla's investigation deadline and blamed social media, and Indian government sites were still serving revoked certificates.
A security team presented a series of iPhone hacking demos at Hexacon in Paris, including attacks beyond third-party apps that reach iMessage. The researchers say everything will be released in due time.
Germany's AfD says its hosting provider was hacked in September and some mailboxes were copied. A hacker published hundreds of thousands of emails, some dated as recently as 12 September 2026. The Hexane.cc leak site shows AI-written summaries graded Low to Critical, with the originals available by torrent. Reports suggest access came via an unpatched website, which is unverified.
Big Tech
Google updated its privacy policy with an exception to its promise not to use Drive, Gmail or Google Photos data for personalized ads. Data shared through Personal Intelligence from connected apps could be used to target ads. Turning on the feature gives Google more data for ad targeting.
Amazon CEO Andy Jassy says AWS capacity is mostly booked through at least next year. A good chunk of 2028 capacity is also sold, though AWS holds some back for on-demand use.
Startups & Funding
Instacart, valued at $12B, has held preliminary conversations with DoorDash and Uber about a sale, according to The Information. The deal would end the grocery delivery app's 14-year run as a standalone company. Shares rose more than 9%.
Agent cloud startup Daytona, which gives each agent its own computer, reached a $1B valuation with FirstMark backing and angels including founders of Stripe, Perplexity, Datadog and Mercor. AI film studio Utopai raised $60M at a $1B valuation, and security investigation startup Mave raised a $28M Series A led by Red Dot.
Developers & Open Source
Starting in 2027, Google will require every Android app developer to register centrally, sign a contract and provide government ID before apps can be installed on any device. That covers sideloaded apps and F-Droid distribution. A campaign page counting down to the change argues it ends Android's open model, and F-Droid has criticised the policy.
Hardware & Science
Counterpoint says shipments dropped to 57M units as memory and other component costs pushed prices up. Lenovo kept the top spot despite a 23% decline.
Show HN and Launch HN
Shows what each agent is doing with a running activity feed and a shortcut to the next unread agent. Includes a unified launcher for Codex, Claude Code and Pi with session search and resume.
An AI wrote a wiki from 45,000 Enron emails, with every fact cited back to its source.
A feed that serves one web page after another, learns what you like and never shows the same page twice.
Also today
Dessa is a full-duplex conversation model trained from scratch on human conversation with no text and no pretrained models. Block shared live chats that are sometimes awkward.
A pull request says the entry used per-query kernels written for the 43 benchmark queries and replayed cached answers on hot runs, both against the rules.
A feature release adding AVX-512 and VAES optimizations for AES-CBC decryption and RFC 8701 GREASE support. It drops Windows-on-Itanium and Windows CE targets.
Sweden's government offices plan to ban the two AI assistants.
A newly disclosed remote code execution flaw called http2shell affects Node, Python and other runtimes.
Quest confirmed patients' personal and health data was compromised, the latest in a series of healthcare technology breaches in recent months.
The abandoned streaming app is still installed on millions of devices, and its apps had to be disabled to prevent them being recruited into a bot army.
Iranian security officials say Tehran has detailed plans to hit undersea communications cables in the Gulf if the US and Israel attack Iran again, according to Reuters.
Read from 83 items posted in the last day on Hacker News, Techmeme, TechCrunch, The Verge, Ars Technica, Lobsters and the YC blog.
Get it every morning
The daily brief at 00:45 UTC, the weekly on Monday. Free, and one click to stop.