Daily AI Scoop · Oct 24 Morning Edition: PHP Vulnerability & DeepSeek Review

Another crazy day in AI — some scary stuff, some fun stuff, and some stuff that just makes you go, huh? Here's what we're covering today. One, the Popcorn Time botnet. Two, MIT's humanities course. Three, Block's Dessa model. Four, a major PHP vulnerability. Five, Carta employees selling shares. Plus a DeepSeek review and a WorkBuddy tutorial. And we'll mention that open-source video at the end. Yeah, sounds good. Let's go one by one, starting with the scariest one. Just saw something on The Verge. Popcorn Time hasn't been developed in years, but millions of devices worldwide still have the old version installed. It uses BitTorrent for P2P transfer, so every client is a node. And nobody's patching it — the vulnerabilities are just sitting there. Here's the key point. It's not just regular software — it's part of a P2P network. One vulnerability can string millions of machines into a zombie army. So in the end they had to remotely force-disable old versions. Without that, there's no stopping DDoS attacks and malware spread. So basically, pirated software doesn't just land you in legal trouble — it becomes a security hazard. Exactly. Lifecycle management for abandoned software used to be a minor ops thing. Now it's a major security issue. Alright, number two. Saw a piece on MIT News — President Sally Kornbluth said at the School of Humanities' 75th anniversary symposium that MIT has never needed the humanities more than it does now. Five years ago, nobody would've taken that seriously. But now it's different — pure technical skills are becoming commoditized fast. AI is great at pattern recognition and optimization, but it can't answer should we do this, who's it for, who bears the cost. So judgment and ethical oversight become the human moat? That's how I see it. Cross-disciplinary collaboration used to be a slogan. Now it's becoming a prerequisite for engineering. Next one's pretty interesting. Jack Dorsey's Block built an AI model called Dessa, designed to chat with you like a new friend. It's trained entirely from scratch on human conversation data — no web text, no books, no fine-tuning open-source models. Really unique approach. It focuses on social pragmatics, turn-taking, emotional responses. And it sidesteps copyright issues and internet text bias. But the trade-off is obvious. Limited knowledge breadth — factual Q&A probably won't work well. In the demo conversations they showed, it's occasionally a bit dumb — which actually makes it feel more human. Right, and they didn't disclose parameters or training data size, and the use cases are unclear. Feels more like a social experiment. Then there's this one — kinda scary. There's a YouTube video about someone using a single prompt to get AI to find a bad PHP vulnerability. And it actually found a high-severity one. After it went public Wednesday, the PHP team rushed out a patch and recommended either updating immediately or taking systems offline. Wikipedia and the Internet Archive were both affected. Cloudflare's CEO said they observed millions of exploitation attempts. And then OpenAI and Amazon got into a spat. OpenAI says AI found it before attackers did. Amazon says hackers may have been four days ahead. That's the security paradox of the AI era. AI makes finding vulnerabilities incredibly easy, but global coordinated patching hasn't gotten any easier. So patch management needs to move to the core of risk response. Exactly. Discovery got faster, remediation didn't — that gap is the new risk source. Here's one that hits workers' wallets. TechCrunch says Carta and NewView Capital are teaming up to let startup employees sell shares early. The pain point is real. Companies stay private longer, the exercise window after leaving is only 90 days, exercising is expensive, and you can't sell your shares. Carta brings the cap table and trading infrastructure, NewView brings the capital and counterparties. Platformizing it definitely lowers the execution barrier. But there's controversy too. Some investors worry that early liquidity weakens the alignment between employees and long-term company value. The other camp says predictable liquidity is how you attract talent. Which side are you on? I lean toward the latter. Loyalty bought by locking up liquidity is usually the most fragile kind. Alright, that's the news. Now let's dig into that super popular review on Bilibili. DeepSeek v4.1 Flash 1017 vs GPT 6.1 Sol — this comprehensive review video has over 38,000 interactions. Really hot. Let me lead with my take. This kind of comparison goes viral not because of who wins or loses, but because people are trying to figure out where domestic models stand. What do you mean? Elaborate. v4.1 Flash is all about efficiency and cost. GPT 6.1 Sol leans toward reasoning ceiling. Comparing them is really comparing two different technical paths. So which side is the Bilibili comment section on? Half the danmaku is cheering for domestic models rising up, the other half is questioning whether the test cases are fair. That split itself tells you something. Wait — are you saying the review itself might be biased? Not biased, but single-point comparisons tend to magnify differences. In real scenarios, cost and latency often matter more than benchmark scores. So the takeaway is — whether a model makes the top tier depends on overall cost and scenario fit, not one review video. Right. And given DeepSeek's pace, they're clearly planning to keep pushing costs down on the Flash line. Quick side note — there's also a WorkBuddy tutorial on Bilibili that's picking up steam. Covers everything from zero basics to file processing and task automation. That doesn't surprise me at all. Tool tutorials going viral means people don't lack models — they lack ways to fit models into their workflows. Last thing — there's a video titled 'My Dad Open-Sourced Again,' with over 600 interactions. Pretty funny. The fact that this stuff goes viral shows open source has become a family meme in the Chinese community. Alright, that's it for today. See you at noon.