Today Boom unveils our first completed supersonic turbine core, a 2GW Superfactory, and—one more thing—the world's most advanced all-digital foundry to cast single crystal turbine blades and vanes

Today Boom unveils our first completed supersonic turbine core, a 2GW Superfactory, and—one more thing—the world's most advanced all-digital foundry to cast single crystal turbine blades and vanes

Today Boom unveils our first completed supersonic turbine core, a 2GW Superfactory, and—one more thing—the world's most advanced all-digital foundry to cast single crystal turbine blades and vanes

Boom! We cracked it! Today we are introducing Boomless Cruise—supersonic flights up to 50% faster with no audible sonic boom. We quietly (har har) demo'd this on XB-1's first supersonic flight—three times actually. 🧵👇

On #2: Andy Grove once said “abandoning today's 'commodity' manufacturing can lock you out of tomorrow's emerging industry” and nowhere is this more true than in pharma and life sciences. Over the last 20 years we have shifted much of the drug discovery process to large Chinese contract research organizations (CROs) like Wuxi—a company which was added to the DoW’s list of “Chinese military companies” in June. We’ve seen this multiple times now. When the work moves overseas, the expertise and infrastructure follow. We're at risk of losing the ability to turn our ideas into medicines. That’s an unacceptable dependency for something so central to our health and our future.

On #1: I was previously CPO and VP of Science at @OpenAI, and I couldn’t be more optimistic about the future. Anyone can use AI today to build an idea in minutes, and we’ve just seen models solve Navier-Stokes and make progress on the Riemann Hypothesis. But the reality is that AI is not yet at the same level in the physical sciences, especially in places like drug discovery where it could do the greatest good. The reason is simple: these are highly emergent and empirical sciences, and they move forward through data and experiment. The models don’t have access to the type and volume of experimental data they need.

💥 Introducing Warp Sciences, a new company applying AI and robotics to help the world develop new medicines faster. We’ve raised a $215M Series A led by @lightspeedvp to bring frontier AI out of the browser and into the lab, and build scientific capacity here in America. I co-founded Warp with my long-time friend @dpatil, FAIR co-founder @manohar_paluri, and drug hunter Sol Reisberg. The early team is full of incredible people like @bkspears9, who helped achieve Q>1 fusion at LLNL.

💥 Introducing Warp Sciences, a new company applying AI and robotics to help the world develop new medicines faster. We’ve raised a $215M Series A led by @lightspeedvp to bring frontier AI out of the browser and into the lab, and build scientific capacity here in America. I co-founded Warp with my long-time friend @dpatil, FAIR co-founder @manohar_paluri, and drug hunter Sol Reisberg. The early team is full of incredible people like @bkspears9, who helped achieve Q>1 fusion at LLNL.

Assumes three things: (1) that the state of the art models are widely available/open-source. That is contrary to what my expectations are w.r.t. incentives. Whether for safety or revenue, OpenAI and Anthropic have reasons to gate their best cyber models and make you pay up for an AI-audit basically. That doesn't slow down sophisticated attackers much: nation-states will pay or build their own anyway. What it does is make AI-assisted defense something only large organizations can afford, leaving the long tail, where most of the easy targets are, exposed. (goes without saying that open source libraries maintained by volunteers are probably toast no matter what) (2) that the security vulnerabilities themselves are "shallow" and easily detectable. If bugs are deep, finding them takes a lot of tokens per line of code, and that's where the asymmetry bites: because defenders have to secure the whole surface area of their codebase against attack, dollar for dollar they will not be able to spend as much in tokens to *harden* every LOC as the attackers will be able to spend to *break* one specific point. A few reasons to doubt (2): a. The PHP vulnerability was a very deep bug that many people overlooked. b. It's been shown that just spending more tokens can get better results. (e.g. the Claude Riemann-Zeta result, where the engineer basically just kept prompting the model to "keep trying") c. ecdsa dot fail, the more tokens get thrown at the problem, the more progress gets made. Implies that spending more on tokens surfaces more insights as you get deeper into the problem. On their own, b. and c. cut both ways: if more tokens produce better results, defenders get more tokens too. They favor the attacker because of the asymmetry: the defender has to spend tokens hardening every line, while the attacker only has to spend them on one. (3) that the pace of software development slows down to the pace of security engineering. If anything, AI is vastly *accelerating* the product/engineering cycles, and exponentially *more code* will be produced in the coming years. Hard to imagine that security tools will be able to keep pace (security is always ignored by everyone until it's impossible not to). Defenders do have home-field advantages: source access, and the chance to scan code before it ships. But that only helps the orgs that actually do it, which brings us back to (1) and (3). So it's not obvious to me that AI favors the defense. In fact, at the limit things will settle to roughly where they stand today: attacker has slight advantage based on the asymmetry of resources they can bring to bear against one, carefully selected target. AI tools can certainly help improve security, but not enough to overcome this fundamental asymmetry and flip the advantage to the defender, imho.

Two critical vulnerabilities have been identified in PHP, a widely used programming language that powers websites and web applications. These vulnerabilities (CVE-2026-109618 and CVE-2026-109619) could allow malicious cyber actors to remotely execute code in PHP core, potentially compromising sensitive data and networks. The FBI urges organizations to take the following steps now: ➡️ If an immediate update is not feasible it is recommended that organizations take the system offline until it can be fully mitigated. ➡️ Immediately update affected PHP installations following the guidance on php.net. Inventory where PHP runs in your environment, prioritizing internet-facing systems and vendor products that bundle PHP. ➡️ Monitor web servers for suspicious activity, including PHP processes unexpectedly launching command shells or downloading files. Ensure appropriate process-monitoring capabilities are in place to help identify potential exploitation. ➡️ If you find signs of compromise, isolate affected systems, preserve your web server and PHP logs, and report it to your local FBI field office or ic3.gov. Those reports help us identify the actors involved and warn other organizations before they become victims. For the latest information, follow PHP’s announcement on php.net, CERT-EU Security Advisory 2026-018, and CISA’s Known Exploited Vulnerabilities catalog.

Two critical vulnerabilities have been identified in PHP, a widely used programming language that powers websites and web applications. These vulnerabilities (CVE-2026-109618 and CVE-2026-109619) could allow malicious cyber actors to remotely execute code in PHP core, potentially compromising sensitive data and networks. The FBI urges organizations to take the following steps now: ➡️ If an immediate update is not feasible it is recommended that organizations take the system offline until it can be fully mitigated. ➡️ Immediately update affected PHP installations following the guidance on php.net. Inventory where PHP runs in your environment, prioritizing internet-facing systems and vendor products that bundle PHP. ➡️ Monitor web servers for suspicious activity, including PHP processes unexpectedly launching command shells or downloading files. Ensure appropriate process-monitoring capabilities are in place to help identify potential exploitation. ➡️ If you find signs of compromise, isolate affected systems, preserve your web server and PHP logs, and report it to your local FBI field office or ic3.gov. Those reports help us identify the actors involved and warn other organizations before they become victims. For the latest information, follow PHP’s announcement on php.net, CERT-EU Security Advisory 2026-018, and CISA’s Known Exploited Vulnerabilities catalog.

Some stats on #php2shell. In the 10 hours before it was publicly announced, across the @Cloudflare network we saw thousands of attempts to exploit it. That jumped to tens of thousands in the 45 minutes post announcement, hundreds of thousands within 2 hours, and millions now.

OpenAI models helped researchers—operating as part of our Patch the Planet initiative—discover critical security flaws in PHP, an open-source programming language used to run an estimated 70% of websites. Over the past two months, we led a coalition of maintainers, researchers, and security providers to prepare fixes and protections ahead of disclosure. This duration was necessary because the fix was quite intricate and required a major change to the PHP engine. Every site using PHP can now safely upgrade their version to stay secure, in addition to applying mitigations from various security vendors. Due to the severity of these flaws and PHP’s widespread use, we consider this bug to be one of the most impactful vulnerabilities in recent memory. It also marks a new phase, where AI can find security bugs with internet-scale impact. This is an example of the Defender’s Window in action: to our knowledge, frontier AI was able to find this vulnerability ahead of attackers, giving defenders time to prepare. openai.com/index/coordinated…

Syren Video is now live and FREE to try! ChatGPT moment for agentic video. Prompt → agency-quality AI video → chat to edit. Powered by Opus 5.5 + Syren renderer w/ 3D support. Browser or Claude MCP. Insane examples in thread 🤯🤯🤯 Try it free here: shorturl.at/r57qy

We’re releasing a broad range of new mathematical results produced by an internal frontier model. We’ve been consulting with the independent Advisory Group on Mathematics and Artificial Intelligence at the Institute for Advanced Study, and we have drawn on their advice and public recommendations to inform how we release these results. github.com/openai/math