So basically, today PHP got two critical bugs that let anyone run code on your server without even logging in, which is bad, and then the details leaked before the patch was even out, which is worse, and it works on WordPress and MediaWiki and Magento and Joomla and Laravel, and Censys says like 1.5 million servers are running a version with no fix, so the NSA was like "take your system offline," and the FBI was like "take your system offline," and CISA and the UK and CERT-EU were all like "take your system offline," and then the Prime Minister of Japan, the actual Prime Minister, posted at 5:55 in the morning telling 48.8 million people to take their system offline, so everyone took their system offline, like the Dutch cybersecurity agency took its own website offline, and the Dutch parliament went offline, and the Port of Rotterdam went offline, and Finland and France and Denmark started pulling government sites, and Wikipedia went down, and Archive.org went down, and Asana and GOG and Something Awful went down, and the University of Vienna's webmail went down for some reason, and that's just PHP. Because GitLab also dropped a CVSS 10.0, which is the highest score they give out, for a bug that's been there since 2014, so that's every self-hosted GitLab for twelve years, and then LiteLLM 1.107.0 got hijacked and shipped a credential stealer and a remote access trojan in every single wheel and the Docker images, including latest, and you didn't even have to import it, just installing it was enough, and it's the second time this year, and then Railway paused every deployment on the entire platform because someone got into the environment variables, so now everyone has to rotate every secret they've ever stored there, and TiDB Cloud said someone was walking around inside with stolen credentials for basically a month and an extortion group says they took 10.6 terabytes, and Zeabur got breached for the second time in two months and is just shutting down, like the whole company, and Node.js patched remote code execution and a TLS bypass, and CISA says Plex is being actively exploited, and someone took over 300 Tor exit relays to steal SSH passwords, and SafePay ransomware has hit over 600 critical infrastructure orgs, and India's biggest bank filed a data loss incident, and Japan has been in an official state of emergency in cyberspace since October 9, which honestly explains the 5:55 AM post. Oh, and eMudhra, a certificate authority that's issued over 60 million certificates, whose entire job is proving websites are who they say they are, was supposed to be using private keys that are random numbers over a hundred digits long, and one of them was 4. Just 4. And the others were like 66 and 237. Anyway, it's Wednesday.

From childhood prodigy to AI pioneer to Nobel Prize winner, Demis Hassabis has always had a simple plan. Step one, solve intelligence. Step two, solve everything else. 🔗 on.wsj.com/4i0Axoo

Introducing Flint, @Recursive_SI’s first model: a fast local coding model built with our automated research system, the Eureka Machine. • Best-in-class fast local coding • Up to 2x faster than comparable models: 125+ tokens/sec on a MacBook Pro, 150+ on RTX Spark • Built from scratch in under 4 months Private, unmetered intelligence on your own machine. Open weights available now on @huggingface, run it locally on your favorite framework or try it for free on @opencode or @pidotdev.

The day the internet broke, and most of it is too old to fix.

Two landmark releases today on recursive self-improvement! What a timeline 🚀 Mirendil (@mirendil) reports pretraining Mirendil-Base, a 100B–500B coding model, from scratch in 3.5 months with one researcher and under $10M of compute; small-scale experiments included. Agents wrote over 99% of the code and ran the experiments, while the researcher chose directions and decided which results to trust. Larger versions are already training. Impressive leverage for a single person. mirendil.com/news/pretrainin… Recursive (@Recursive_SI) released Flint, an open-weights 40B coding model for fast local use. They built it from scratch in under 4 months with their automated research system, the Eureka Machine. Great to see autoresearch ship an actual model people can run. recursive.com/updates/introd… The framing seems to differ a little. Mirendil is reducing the people, compute and time needed per model, with a human directing agents. Recursive's Eureka Machine aims to automate more of the research loop itself. Both start with coding models, on the view that better coding speeds up AI research.

Sparks of abundance by 2029

看了一下DeepInfer的数。我觉得吧，前几天大家转载的那个SiliconData Index的价格，未来一年估计还得不回头地跌个95%+，具体什么时候影响到GPU Rental rate蛮难预测的。 这个价格体系下，梁圣买张卡估计100天就回本了。一旦有朝一日token价格真的暴跌到影响rental rate，所有股价肯定已经跌了一大轮。 给大家几个数，所有的数都是$ / 1 mm token，基本上1mm token 95% cached = 100-150页的薄书. - Dylan一直在说Jane Street的变现价是$100-200 USD / 1 mm token - Opus 5.5 / GPT Astra 的价格在deepinfer的体系下大概是1-2 USD / 1 mm token，比标价便宜个80-95% - 变态的来了，Deepseek 4.1 Flash off-peak的价格在这是1.5美分，又比SOTA便宜个90%。 - 按照一般的大B300 Cluster，根据deepinfer的计算，一个GPU大概能每小时产出2.7 Bn token, 成本换算过来大概是0.25美分 / 1 mm token，这已经比我想象中便宜很多很多了。之前算过我记得是15美分 / 1 mm token，不过没有计算cache。这个level的成本大概率是大机房+高使用率+超高存储时间，一般机房估计都做不到这个theoratical. - 这也就是大家看到的80-85%毛利 (1.5 / 0.25)。DeepSeek要是以比这个利润率稍好的功率赚钱的话，一个B300大概2-3个月回本，而不是8个月。真是无与伦比的暴利，比贩毒爽多了，自然是砸锅卖铁也要走私B300。 - 如果B300按照break even算的话，那么成本大概是0.13美分 / 1 mm token. 然后原材料其实是B300 ～600k价格的6%不到（按照产业链毛利计算）。 - 所以最后算下来马斯克如果去完全积压的话，每1mm token的最终生产成本可能是0.01美分, or 0.0001 USD。这基本上跟免费差不了太多了。 这种屠夫版的价格我不知道你怎么看，但是when you see the headline API price of Opus @ 8/40 USD input/output，我只能感觉说只要OSS + Post-train和中国模型蒸馏大法能够持续跟随 + 没有新的breakthrough，token 价格未来一段时间应该是以断崖式的下跌。至于什么时候触碰到rental rate, maybe someone smart can tell me.