skcd retweeted
Full details of a remotely exploitable vulnerability in the core engine of *all* PHP versions will be released tomorrow, October 21st. If your organization has internet facing PHP applications then you need to be ready to patch the minute the update is released or *strongly* consider taking the application offline until you can:
php.net/index.php#2026-10-20…
🚨 PHP warns of two critical vulnerabilities as emergency patches arrive tomorrow
The PHP security team will release updates on October 21 at 14:00 UTC for two vulnerabilities, each rated 9.2 under CVSS v4.0.
â €
Security researchers identified the flaws as CVE-2026-109618 and CVE-2026-109619 and described them as remote code execution vulnerabilities reportedly affecting PHP versions 5 through 8.
PHP has not yet confirmed the affected versions, exploitation requirements or fixed releases.
â €
The vulnerabilities were reportedly leaked before their planned disclosure. Researchers said they have not observed active exploitation, while PHP warned it may release the patches early if technical details become public or exploitation is detected.
â €
Administrators should identify PHP installations now and prepare to apply the updates as soon as they become available.
skcd retweeted
I've published a new, general-purpose terminal specification that gives any program a way to tell the terminal what it's doing: idle, working, waiting, finished, or failed, and why. It is easy to implement on both sides. I've written more about why: mitchellh.com/writing/progra…
The problem this solves is generic and applies in compelling ways to all sorts of use cases (e.g. package managers, build tools), but it really rears a hideous head when it comes to AI and the "agentic inbox" problem.
I found over 250 different agent orchestrators (with various goals) that all individually implement a heuristic based approach to detecting whether things like Claude Code are working, blocked, done, etc.
If you look at @herdrdev's commit history, you can see around 10 compatibility changes to detect Claude Code within just the past 3 months. (This isn't a dig at Herdr! They're doing great work with what they have, and everyone else is doing the same thing).
Heuristics are not the way. And over-indexing on agentic use cases isn't the way, because this problem is really interesting for other tools too: Homebrew, Terraform, Cargo, etc. etc.
Proprietary protocols and out of band APIs are not the way. They have an O(N) integration problem and require extra work to work over SSH or within local VMs/containers.
The program status specification (OSC 7501) solves this in a reliable, deterministic way that is general-purpose and can be easily adopted by the entire industry.
Read more: mitchellh.com/writing/progra…
skcd retweeted
First PSSR came to PS5 Pro. Now Quick Spectral Super Resolution (QSSR) is coming to PS5.
Details on new upscaling tech, coming first to Marvel’s Wolverine and Ghost of Yōtei: play.st/4hjL9yo
astra is running a loop where its checking my battery and making sure I have enough charge on my laptop... it stops if the batter drops below 5% cause it might have builds running which would get cancelled??
skcd retweeted
I can’t stress enough how little an idea matters compared to the agency of the people executing the idea.
I have had the privilege of knowing and sometimes even working with some of the most successful people (by various metrics).
The difference between mediocre and excellent work and outcomes is predominantly one of agency.
In practice this means: they dont wait for things to happen to them they go out and make things happen for them.
They don’t wait for someone else to do something, for someone to teach them, for someone to give them the path, etc. They just go out and find a way to do it.
I think the single biggest superpower these people have is the realization/belief that the world around them is completely mutable. Most everything that happens is because a person made it happen.
I used to tell people to look around the room you’re sitting in. Look at everything. Every noun. It almost all exists because a person willed it into existence. Nothing is stopping you from doing the same.
I see people online all the time dismissing someone else’s success because “I had that idea first” or whatever. I mean… yeah? If so then the difference is… you. So a bit of a self own whenever I hear that.
Number one tip: act with agency.
skcd retweeted
If the same general agent can understand a car, an arm, a humanoid, etc. through their sensor/action interfaces, you start to decouple intelligence from the hardware platform itself.
“LLM as puppeteer” is probably just the beginning. The bigger shift might be robots converging on an abstraction layer where a general agent can express intent without needing to understand the low-level control details of every embodiment.
Almost like a hardware abstraction layer for physical intelligence.
Recently, there have been a lot of impressive demos of AI agents, like Claude, controlling robots.
I wrote a short blog post with my thoughts on the advent of these "robot-use agents."
web.mit.edu/phillipi/www/wri…
I think it's an important change in the trajectory of robotics!
a more nuanced take about "can a LLM control a robot?" implies
I think “can an LLM control a robot?” is slightly the wrong question. With enough compute and enough time between actions, probably yes. What’s more interesting is what has to change in the architecture, training, and inference for these models to operate at robot speed.
Robotics operates at multiple timescales. Deciding “Pick up the pan and place it on the stove.” can happen relatively slowly. Maintaining balance, correcting a slipping grasp, reacting to contact, or adjusting a joint trajectory cannot.
A model that has to autoregressively generate a sequence of tokens before every physical correction is paying an enormous latency tax for capabilities you often don’t need at that layer. Making the LLM 2x or 5x faster helps, but it doesn’t really change the shape of the problem.