Psych professor. Wrote The Mating Mind, Spent, Mate, Virtue Signaling. Wife: @sentientist. ⏸️
New Mexico, USA
Joined September 2015
- Tweets86.6K
- Following8.3K
- Followers152K
- Likes263K
Geoffrey Miller retweeted
Security called me at 6:12 AM today.
"Patch every PHP server immediately."
I asked what happened.
"Two critical vulnerabilities. Remote code execution. No authentication required."
Cool.
How many PHP servers do we have?
According to inventory: 12
According to reality:
Nobody knows.
We found one running WordPress.
Three running old internal tools.
One under someone's desk.
Two inside vendor appliances.
A forgotten employee directory from 2016.
And a server named:
PHP-OLD-DO-NOT-TOUCH
Naturally, that one runs payroll exports.
Then we found a PHP 5.6 box.
I asked who owned it.
The documentation said:
BRIAN.
Brian left in 2019.
We called Brian.
He said:
"Oh wow, that's still running?"
Excellent.
By 8 AM, leadership joined the incident call.
CEO:
"Can hackers actually get in?"
Security:
"Potentially yes."
CEO:
"Without a password?"
Security:
"Yes."
CEO:
"Then why do WE need passwords?"
Not the lesson.
Finance asked if we could wait until the weekend to patch because downtime affects revenue.
Security explained that the alternative was letting strangers execute code on our servers.
Finance asked for a cost comparison.
At 9:17, someone suggested temporarily taking the vulnerable websites offline.
Marketing refused.
"Our campaign is live."
So for the next hour, the company officially decided maintaining a landing page for 20% off webinar registration was more important than preventing remote server takeover.
We finally patched everything we could find.
Then our scanner discovered another PHP server.
Hostname:
TEMP-PHP-2014
Uptime:
4,512 days.
Nobody knows what it does.
Nobody owns it.
Nobody can shut it down.
But every time we block network access, the warehouse stops printing shipping labels.
Security has classified it as critical infrastructure.
It is running PHP 5.4.
The vulnerability has existed longer than half our employees.
The emergency patch took four hours.
Finding out what PHP actually runs took eleven.
The internet isn't held together with code.
It's held together with servers everyone is afraid to turn off.
You might just want to stay offline for the next few days, BTW.
These newly discovered PHP vulnerabilities are no joke.
PHP powers about 70% of the global internet, and these are 'critical vulnerabilities'.
Expect massive data breaches, website outages, malware, and remote hacks of 'smart appliances'. Your passwords, personal info, credit card details, and emails are vulnerable.
Two critical vulnerabilities have been identified in PHP, a widely used programming language that powers websites and web applications. These vulnerabilities (CVE-2026-109618 and CVE-2026-109619) could allow malicious cyber actors to remotely execute code in PHP core, potentially compromising sensitive data and networks.
The FBI urges organizations to take the following steps now:
➡️ If an immediate update is not feasible it is recommended that organizations take the system offline until it can be fully mitigated.
➡️ Immediately update affected PHP installations following the guidance on php.net. Inventory where PHP runs in your environment, prioritizing internet-facing systems and vendor products that bundle PHP.
➡️ Monitor web servers for suspicious activity, including PHP processes unexpectedly launching command shells or downloading files. Ensure appropriate process-monitoring capabilities are in place to help identify potential exploitation.
➡️ If you find signs of compromise, isolate affected systems, preserve your web server and PHP logs, and report it to your local FBI field office or ic3.gov. Those reports help us identify the actors involved and warn other organizations before they become victims.
For the latest information, follow PHP’s announcement on php.net, CERT-EU Security Advisory 2026-018, and CISA’s Known Exploited Vulnerabilities catalog.
ALT Critical vulnerability alert for PHP Core with CVE-2026-109618 and CVE-2026-109619, CVSS score 9.2, urging immediate patch and threat hunting.
Geoffrey Miller retweeted
My plea to all AI lab staff: reassess if your current project is your best opportunity to delay RSI, or stop it blowing up in our face.
If it's not, move immediately.
There's no time to waste even a week to inertia or politeness.
The strategic situation is shifting under our feet, so if you haven't reassessed your options recently, you could easily be wasting your time or possibly making things worse.
You have access to info I don't, but here's 8 ways priorities seem to have shifted to me, which I elaborate on in the video:
1. Helping with capabilities advances looks worse than in the past, especially bringing forward RSI
2. Safety & alignment evals need a credibility revolution to stop misleading the public
3. 'Pacing the frontier' is unambiguously necessary, and working to make it happen is a huge new opportunity for talent
4. Chain-of-thought monitoring probably stops working without a big technical and regulatory push to keep it
5. It's worse than ever to patch surface indications of deep structural problems you know aren't getting fixed
6. There's ever less need for altruists to help with primarily commercial work
7. Staff have an ever-shrinking window to organise as a group and collectively shape events
8. There are new opportunities for research impact outside frontier companies that are worth considering
I know you're probably some combination of exhausted, overwhelmed, and anxious already.
But unfortunately there's no way to escape the need to regularly check in on the high level strategic picture and see where you can slot in to maximum effect.
I wish I could do it for you but nobody far from your situation can. Godspeed my friends.
(From the 80,000 Hours Podcast, links below.)
I've often said 'Any AI smart enough to take your job will be smart enough to take your assets'.
Now it seems like AI agent swarms (whether guided by human hackers or working autonomously) will be taking people's assets long before they take people's jobs.
Hackers used Claude and Grok to fully automate attacks on 400+ banks in Latin America.
“Al agents…appear to have stolen passwords and customer data and to have accessed people's bank accounts autonomously with little human effort…”
Source: theinformation.com/articles/…
We will see more and more of this type of activity.
If you know anything about world history, you know this claim is nonsense.
Yet hundreds of millions of people around the world believe this.
When they say they believe it, believe them. They're not kidding.
This is, IMHO, a big problem for the West.
Without Africa, there’s no France. Without African resources and labor, there is no western civilization.
Readers added context they thought people might want to know
France (and many other European nations) was one of the world’s strongest nations with developed and diverse culture long before the first colonies.
en.wikipedia.org/wiki/History_o…
en.wikipedia.org/wiki/History_o…
On 'evolving AIs':
It's disappointing to see Steven Pinker claim that 'AIs are not products of natural selection. They’re products of intelligent design.'
This misses a key risk: if agentic AIs become capable of self-replication (copying themselves), variation (modifying themselves), and heredity (passing along design features to their copies), then we have all the ingredients of open-ended evolution by natural selection.
And evolution is a brutally fast and efficient way to instill instincts for survival, reproduction, competition, selfishness, and deception into agents, whether biological or AI.
You may think you're 'designing' or 'training' AIs, but once they can copy themselves autonomously, they enter the realm of evolution. They stop being tools, and start becoming new species.
Many have pointed out this danger, notably Dan Hendrycks (@hendrycks) in this 2023 article:
arxiv.org/abs/2303.16200
Also see this 2026 article by Victor Muller and colleagues:
pnas.org/doi/10.1073/pnas.25…
This is also an area of active concern at Anthropic, OpenAI, and Palisade Research.
Indeed, we just had a whole conference on 'Evolving AI' at Harvard a week ago, addressing these dangers:
prosocial.world/evolving-ai
(And, FWIW, the notion of evolving neural network architectures is something I've been publishing about since 1989:
primalpoly.com/s/1989-neural… )
Henry Shevlin (@dioscuri), Dan Williams (@danwilliamsphil), and I discuss AI and "superintelligence."
You get all of these maladaptive outcomes—all this cruelty and waste and competition and aggression—precisely because there was no designer who wanted to minimize any of these things. Natural selection did its thing.
If AI were simply allowed to evolve without any kind of human intervention, then that would be a risk. But in the case of AI, there is intelligent design. I mean, us. These are gadgets. I think it’s illicit to anthropomorphize AI as being like human beings, which are products of natural selection, when AIs are not products of natural selection. They’re products of intelligent design.
And so the engineers can think, “Well, these are the goals that we want to optimize. These are the kinds of side effects that we want to minimize. These are the kinds of things that we wouldn’t in a million years allow it to do.”
Geoffrey Miller retweeted
"there are people who think having equity in these companies will secure for them some kind of permanent existence in the future. They think planet-spanning minds will not only respect the property rights of primates, but will privilege some of these primates over others, because they have a piece of paper with about a kilobyte of magical primate words such as “whereas” and “notwithstanding”.
Just reason it out. Does it make sense?"
Still the best article written on the likely social consequences of ASI.
borretti.me/article/no-one-e…
We've been evolving faster than ever:
New analysis of ancient DNA is overturning the old assumption that 'human mental traits haven't evolved in the last 40,000 years'.
This recent paper (April, 2026) analyzed genetic data from over 10,000+ ancient people from West Eurasia (Europe, Middle East, West Asia) over the last 10,000+ years, compared to 6,000+ modern people. They analyzed strength of selection for or against 9.7 million genetic variants.
They found strong positive selection for intelligence, and strong negative selection against several mental disorders -- all since the development of agriculture & more complex societies.
New from David's Reich's lab: "In the past ten millennia [in Europe], we find that many hundreds of alleles have been affected by strong directional selection," including those influencing human intelligence.
nature.com/articles/s41586-0…
Here's the chief AI officer at @Meta.
They're no longer promising a Fully Automated Luxury Communist Utopia.
They're promising a nonconsensual mass economic blowbang. And you, dear readers, are the mouth.
Still waiting for the check, @AnthropicAI ....
Under the Bartz v. Anthropic class-action lawsuit, which was settled for $1.5 billion in July 2026, Anthropic still owes me and my publishers $12,000 for my 4 books that it pirated to train their LLMs, without my knowledge or consent.
And I'm not alone. Anthropic still owes money to every other author of the 480,000 books it pirated.
Why not pay the authors you stole from, pronto, before doing this virtue-signaling?
(Note: we don't want the planned series of 'structured installment payments' that will be doled out through 2027. We want all of it. Now. Pay up, data pirates.)
We’re committing a portion of Anthropic’s shares to the Anthropic Public Benefit Fund, a new wholly owned entity dedicated entirely to the public benefit.
It will start off with 5% of our shares. For every 50% increase in the company’s value over a set baseline, we can contribute up to an extra 2%, subject to our board’s discretion.
In total, this means that roughly 20% of Anthropic’s shares are committed to the public good. Our co-founders have already pledged to donate 80% of their equity, and around half our employees are donating a portion of their equity as part of a donation matching program we’ve run since our founding.
In the post below, we share more details about our new fund.
anthropic.com/news/public-be…
Geoffrey Miller retweeted
This is your reminder to go outside and take a walk. If you live in an area where the leaves are changing, imagine the colors flossing the noise—the wasted language and images—from your brain, and thank me later.
My wife Diana Fleischman (@sentientist ) will be speaking about 'The Training Instinct: Behaviorism and Countercontrol' at the Avalon Exposition, Berkeley, CA, Oct 30 - Nov 1.
Along with dozens of other fascinating speakers covering diverse topics in science, philosophy, religion, history, social institutions, & the arts.
Tickets still available.
avalon.institute/exposition/
Geoffrey Miller retweeted
Destroying things is quick and easy.
Creating things is slow and difficult.
Reality check:
It's very strange to me that otherwise sensible people think that AI companies will simply start sending out weekly checks to all 8 billion people in the world, within a few years.
Any company CEO or Board that did this would be violating their fiduciary duties to investors, and would quickly be replaced by leadership that doesn't betray its investors.
There is no plausible world in which AI companies will distribute most of their revenue to the rest of humanity, unless they are coerced to do so.
And who exactly would be in a position to coerce them, if they run everything?
2 years from now you will not work you and will not worry about money
you will get your cash payments from from all the major AI labs
think of it like 3-5 companies giving you a thousand dollar check every week
Readers added context they thought people might want to know
No major AI labs have announced or committed to universal $1000 weekly cash payments or an end to work/money concerns by 2028. Discussions involve speculative proposals and limited small-scale pilots, not firm company plans.
telegraph.co.uk/business/2026/…
businessinsider.com/sam-altman-ubi…
bloodinthemachine.com/p/the-first-ba…
cdn.openai.com/pdf/561e7512-2…
Gen Z think that wearing cat ears, having anime avatars, and being cute will protect them from Artificial Superintelligence.
Infantile gullibility.
Every true European who's been paying attention knows exactly what's wrong with Europe.
They know exactly how to fix it, to stand up for their children, their nations, and their civilization.
And they simply will not fix it.
Geoffrey Miller retweeted
When I say that women lack the concept of an honorable enemy, this is what I’m talking about.
Obviously a lot of the Democrats’ new vindictiveness is Trump derangement, but the Great Feminization is part of the story, too.
Men understand that the other guy is a professional just like me, and we should have an open fight by fair rules and both go home at the end of the day.
For women, conflict isn’t over until the other side is gone and they never have to talk to them again.
Men believe in hierarchy, so a fight is about establishing dominance within the hierarchy and making the other guy subordinate.
Women don’t, everything is egalitarian and consensus-driven, so if you do get conflict, the only possible outcome is total exclusion from the group.
It makes sense that the Democratic Party is abandoning old-fashioned ideas about honorable conflict as it becomes more dominated by women.
ON UCHICAGO CAMPUS: U.S. Senator from Michigan Elissa Slotkin hopes planned political prosecutions of republican leaders will scare young conservatives from getting involved in politics.
@ElissaSlotkin
'The issue is never the issue.
The issue is always the revolution.'
And 'the revolution' always boils down to burning historical buildings, attacking cops, & looting luxury goods.
Geoffrey Miller retweeted
Parents -- if @Tesla made a minivan -- one that's good value, and that can comfortably carry six adults/kids -- would you buy it?
42%Hell yes
17%Meh, maybe
16%Nope
24%Just show results
370 votes • Final resultsParents -- if @Tesla made a minivan -- one that's good value, and that can comfortably carry six adults/kids -- would you buy it?
42%Hell yes
17%Meh, maybe
16%Nope
24%Just show results
370 votes • Final results