PHP2Shell, Claude Duet, and the architecture beneath today

00:00:04 Two unpatched critical-severity vulnerabilities in PHP's internal handling of out-of-memory conditions were disclosed yesterday. They go by PHP2Shell, carrying CVE identifiers 2026-109618 and 2026-109619. The flaws hit a language that still hosts most of the web.

00:00:23 Researchers demonstrated remote code execution against WordPress, Drupal, and Joomla without authentication. What's notable isn't just the vulnerabilities themselves. It's the timeline around them. Participants say about two months of coordinated remediation preceded the public disclosure — work spanning PHP Foundation maintainers, independent researchers, Cloudflare (which rolled out WAF mitigations before the patch dropped), and government agencies notified confidentially in advance.

00:00:59 The discovery came from at least two separate parties using AI models. One group working through OpenAI's Patch the Planet program used GPT-5.6 Sol. Another from Wiz — recently acquired into Google Cloud — used Gemini 4 Argon alongside GPT-5.6 Sol and their own tool, Wiz Atlas.

00:01:19 Trail of Bits put it this way in a post yesterday: "When AI can develop a working exploit in hours, bugs need to be patched just as fast." Within 17 hours of rumors circulating about the unpatched bugs, Cloudflare was blocking attacks and Patchstack reported active exploitation.

00:01:40 That two-month window matters because it shows both what works under coordination and where the friction lives. Two months is a long time for vulnerability disclosure in an industry that's gotten used to zero-day-to-patch timelines measured in days. But PHP's patching process involves a distributed maintenance community, not a single vendor pushing updates through its own infrastructure.

00:02:08 The effort maps onto OpenAI's "Defender's Window" concept — advanced models finding flaws before attackers use them. Their language is "to our knowledge," which means it's a strong claim without being proof that no attacker already knew. The operational reality for PHP operators on Wednesday was messy: patching requires locating PHP installations across managed hosting, containers, background workers, and older applications; obtaining the right packages; deploying them; restarting affected processes; and verifying what's actually running.

00:02:48 The NSA account that advised preparation called it a serious situation and recommended taking systems offline if timely mitigation wasn't possible. Getting fixes into every running instance remains a distributed-maintenance problem with human coordination. What I'll watch next is whether that two-month disclosure window actually holds up under active attack pressure.

00:03:16 Anthropic opened a research preview of Claude Duet yesterday. The launch matters as a product category shift rather than a simple feature toggle. Claude Duet is a separate app — available on iOS, Android, and claude.ai — not a mode inside the main Claude application.

00:03:34 It has its own install, carries over your memory and skills, and runs on Opus 5.5 across what Anthropic says are 6,000 connectors and plugins through the Claude Marketplace. The proactive part works like this: Duet checks your connected accounts every few hours, sends you a morning brief, and messages you when something needs attention.

00:03:58 Before it sends a message, makes a payment, signs a document, or deletes anything, it shows you what it's about to do and waits for approval. Trading securities and moving money between accounts are off the table completely. Amol Avasare — Anthropic's Head of Growth — announced it with this claim: over the past few weeks it's become the main way he gets work done.

00:04:24 He described it as built for work with very high judgment that prioritizes safety and security over engagement, rather than being just another personal agent chasing engagement. Dan Shipper, who has been tracking AI productivity tools for years, confirmed a meaningful shift in his own usage: after two weeks of testing, he'd moved from mostly using ChatGPT to roughly 50-50 with Claude Duet.

00:04:51 He called it the first personal agent he'd consider a pro tool. The practical constraint here is usage limits. The research preview sits inside Anthropic's existing Pro and Max plans — no separate price yet, but background checks burn into the same usage windows as foreground sessions.

00:05:11 A background agent polling every few hours on a Pro plan could eat through those 5-hour windows fast during complex tasks like building a financial model or preparing a deck. The app runs in its own virtual machine with its own browser — you can't see that browser yet, which is an interesting design choice for a product whose whole value proposition involves doing things on your behalf.

00:05:38 Anthropic's own caveat reads: "This is an early version of Claude Duet, and it still might misread a thread or miscalibrate what's urgent." If Duet becomes its own persistent installation rather than an embedded feature, it points to Anthropic seeing proactive agents as a distinct category, not just an incremental model update.

00:06:06 The local pass today reads the infrastructure layer first. PHP2Shell sits at about three on the meaningfulness scale — significant for operators who maintain PHP instances, but not a paradigm shift in how AI works. Claude Duet is closer to directional; it's a separate app architecture that signals Anthropic sees proactive agents as its own category rather than a feature inside the main product.

00:06:32 The evaluation methodology from Air Canada is the item I'm carrying forward. The principle — if you can't grade the agent, you can't make it better — is obvious in hindsight and worth practicing before the problem shows up on your own team's timeline.