Good Starship highlights video

Full duration 33-engine static fire for the Super Heavy booster preparing for Flight 15

Tesla Roadster wing and back end

We’re adding long press on like to send someone $1 via 𝕏 Money

Watch Episode 1 of our Odyssey series made with Grok Imagine. Let us know in the comments if you'd like a full breakdown of how it was done! Creative collaboration with @WonderStudiosX and director Dev Walker @glumlot_

The phone that becomes a robot…

SpaceXSI just launched Grok for Startups, giving ambitious founders access to the entire Grok ecosystem to build and scale their companies One shared credit balance across Grok, Grok Build, Grok Bot and the Grok API, designed to support months of real startup usage And the possibilities are incredible: • Build and ship code with Grok Build cloud agents • Automate sales, recruiting and weekly reports with Grok Bot • Integrate frontier Grok models directly into your own products • Get 20% of approved credits upfront, with the remaining 80% unlocked after onboarding • Dollar-for-dollar spending matches for six months, up to a cap • Hands-on onboarding and direct support from the startups team Small teams can now accomplish with this level of technology and infrastructure behind them Building an ambitious company has never been this accessible x.ai/startups

Elon Musk has reportedly invested around $1 billion in Skydance, the media giant led by David Ellison, son of Oracle founder Larry Ellison, and behind Paramount, CBS, Warner Bros., HBO and CNN, according to Semafor. Elon Musk has not yet confirmed the investment.

Security called me at 6:12 AM today. "Patch every PHP server immediately." I asked what happened. "Two critical vulnerabilities. Remote code execution. No authentication required." Cool. How many PHP servers do we have? According to inventory: 12 According to reality: Nobody knows. We found one running WordPress. Three running old internal tools. One under someone's desk. Two inside vendor appliances. A forgotten employee directory from 2016. And a server named: PHP-OLD-DO-NOT-TOUCH Naturally, that one runs payroll exports. Then we found a PHP 5.6 box. I asked who owned it. The documentation said: BRIAN. Brian left in 2019. We called Brian. He said: "Oh wow, that's still running?" Excellent. By 8 AM, leadership joined the incident call. CEO: "Can hackers actually get in?" Security: "Potentially yes." CEO: "Without a password?" Security: "Yes." CEO: "Then why do WE need passwords?" Not the lesson. Finance asked if we could wait until the weekend to patch because downtime affects revenue. Security explained that the alternative was letting strangers execute code on our servers. Finance asked for a cost comparison. At 9:17, someone suggested temporarily taking the vulnerable websites offline. Marketing refused. "Our campaign is live." So for the next hour, the company officially decided maintaining a landing page for 20% off webinar registration was more important than preventing remote server takeover. We finally patched everything we could find. Then our scanner discovered another PHP server. Hostname: TEMP-PHP-2014 Uptime: 4,512 days. Nobody knows what it does. Nobody owns it. Nobody can shut it down. But every time we block network access, the warehouse stops printing shipping labels. Security has classified it as critical infrastructure. It is running PHP 5.4. The vulnerability has existed longer than half our employees. The emergency patch took four hours. Finding out what PHP actually runs took eleven. The internet isn't held together with code. It's held together with servers everyone is afraid to turn off.

AI Found Memory Flaws in the PHP Engine That Let an Attacker Take Over Servers Running Most of the Web The PHP security team released emergency patches on October 21 for two critical vulnerabilities in the language’s core engine. Both carry a CVSS v4.0 score of 9.2. Successful exploitation gives an unauthenticated remote attacker code execution as the web worker on any server running a vulnerable PHP version. PHP runs on roughly 70 percent of websites whose server-side language is known, according to W3Techs measurements that have held in that range for years. WordPress, Drupal, Joomla, Magento, Laravel, and plain scripts are all exposed when the underlying interpreter is. The issues are tracked as CVE-2026-109618 and CVE-2026-109619. They are not bugs in application code. They sit in the engine’s handling of request memory and fatal errors. Wiz Research reported the first of them in August after using its Atlas system together with Gemini 4 Argon and GPT-5.6 Sol. The models helped locate the conditions, chain the memory effects, and adapt the resulting exploits across PHP versions, SAPIs, and heap layouts that a single researcher would otherwise have spent months mapping by hand. A working unauthenticated proof of concept against current WordPress and Drupal containers was ready within days of the initial finding. The company later posted a technical write-up under the name PHP2Shell. The core mechanism is the engine’s use of longjmp() to abort a request on out-of-memory. PHP treats memory exhaustion as fatal and jumps out of the current context rather than running normal cleanup that might itself allocate. In several paths—multipart form parsing that expands headers or nested fields beyond the apparent post_max_size and memory_limit, session upload-progress handling, and certain error-backtrace or OPcache persistence steps—request-owned structures are allocated and then left partially initialized or still referenced from process-global state when the jump occurs. The request heap is later freed, but the globals (BG(unserialize), EG(last_fatal_error_backtrace), session identifiers, and similar) continue to point at the now-invalid memory. A later request processed by the same worker can read or write through those stale pointers before normal initialization replaces them. With a controlled heap layout the result is a use-after-free that yields arbitrary read or write and, in the demonstrated cases, full code execution. One advisory describes the OOM path in detail: a multipart request can force allocation failure during startup or early parsing; longjmp() skips the matching reset; shutdown or the next request’s early diagnostics then operate on the corrupted state. The companion advisory covers the broader stale-global case, where fatal errors, non-fatal diagnostics during shutdown, or interrupted session operations leave request memory reachable across workers. Both were confirmed to produce unauthenticated remote code execution under default limits on common configurations such as Apache mod_php with prefork. Memory disclosure of other requests’ data (credentials, tokens, keys) is also possible. The flaws have been present since at least PHP 5.4; every version released in the last decade is affected by at least one of them. Patches are available for the supported branches: 8.2.35, 8.3.36, 8.4.27, and 8.5.12. Older branches receive no official fix. Estimates of exposed internet-facing hosts that still advertise a version range from roughly 1.3 million upward, with a substantial fraction on end-of-life releases that cannot be updated in place. Some hosts have already disabled session.upload_progress as a temporary mitigation while waiting for the packages. Early scanning and exploitation attempts were reported on the morning of the release. 1 of 2

Elon Musk: “I once had a dinner at my house with a physicist and a computer scientist, and they're both like leaders in their field. And I asked the question, what do you think the probability is that we're in a simulation? And the physicist said 0% and the computer scientist said 100% simultaneously. So I guess maybe I should go 40% then.”

Elon Musk: "We're seeing the fastest growth of a product that I've ever seen in my life for Grok Bot" "I've never seen anything grow this fast" Usage per user grows over time instead of declining. As Grok Bot gets more useful, people use it more each week Next up is enterprise. Grok Bot is already in early deployment with trusted customers, and wide enterprise deployment is expected within a few weeks, so companies can use it in teams "as though it were a virtual human" "I think Grok Bot may end up being what uses most of our super intelligence compute"

Horses vs. Flying Cars Almost 100 years apart. I can’t even imagine what the next 100 years will look like

Johann Sebastian Bach is the Shakespeare of music. Best there ever was.

Next year, I will give one of my SpaceX shares to every kid in America. This will be the first of many.

— the beauty of sea waves 🌊

Old school cool.

Imagine being so utterly devoid of wonder, ambition and imagination that you can't comprehend the possibilities of flying cars.

Designed, engineered, and made in America

HAPPENING NOW: Alex Jones GLAZES Elon Musk! With The World’s First Flying Car On DECK, Elon Musk Tells George Jetson, “HOLD MY BEER!” 🔴WE ARE LIVE, TUNE IN NOW NOW NOW NOW!