AI-Assisted Exploits Hit Every Stack as PHP Patch Response Exposes Vendor Gaps

Key Takeaways

1. AI-assisted exploitation is spreading beyond PHP to Node and other stacks, with defenders and attackers both using AI.
2. Vendor response to the PHP security release is being read as a selection signal, while unpatched sites still outnumber patched ones.
3. A two-person Shopify pet-treat brand reports AI-search visibility and traffic gains through Outrank.
4. Microsoft Research's PDD Kit proposes formal specs and Verus proofs for Rust, falling back to tests when proofs fail.
5. Kaku added remote Mac access and natural-language command generation; its developer describes mixing Swift, Rust, JS, Lua and C.
6. China's consumer 3D-printer exports rose 90% in the first half, with Chinese firms holding 96% of global share.

1. Security and AI-Assisted Exploitation

1. @levelsio argued that AI-assisted exploits will affect all languages and frameworks, not just PHP, citing Node's high-severity patch this week and describing an endless AI-versus-AI cat-and-mouse phase in cybersecurity; he also relayed a claim that Railway was hacked 1 2. Jack Ellis said more PHP sites are vulnerable than patched and most people were unaware of the day's events, while rating vendor responses to the mass PHP security release: Laravel best, DigitalOcean six hours late with nothing the prior day 3 4. Arvid Kahl said the volume of vulnerabilities made him understand why frontier models have internal triggers on cybersecurity prompts, and called the transition period of finding and fixing old software flaws very painful 5. Separately, Ellis said he had gained access to Mythos 5.1 to run test attacks on Fathom 6.
2. Arvid Kahl argued for abandoning the concept of EOL entirely and pointed to PDD (Proof Driven Development) as the way forward: TDD is good, but agent-written tests are so cheap that many developers skip review, while PDD could improve clarity and precision 1 2. The cited PDD Kit from Microsoft Research turns plans into formal specifications, uses Verus to prove Rust code meets them, and falls back to tests and a computer-use agent's empirical verification when proofs fail, aiming for engineers to review specs rather than code 3. He also relayed that the Sury PHP image maintainer backported patches to 5.6, calling it a huge public service 4.
3. Arvid Kahl pushed back on hand-coding-only positions: rather than manually changing one config line, he would have an agent change a queue size from 3 to 10, check side effects and resource races, and update docs in sync; he argued agents can assess system-wide and load impact, locate docs needing updates, identify potential races and run all available tests, and that small changes causing unexpected cascading effects are markedly rarer in agent systems with full context and focus 1. Jack Ellis said he had lost patience with GitHub and planned to move his CI pipeline off GitHub Actions due to frequent outages, acknowledging growth pains but citing repeated problems and Microsoft's backing 2.

2. AI Search, Products and Developer Tooling

1. Tibo relayed that a two-person Shopify pet-treat brand using Outrank appeared in Google AI Overviews, AI Mode, ChatGPT and Copilot; its domain rating rose from 1 to 31 and organic traffic from near zero to 1,000+ monthly users, 95% from the blog, with the brand saying its internal team spent almost no extra effort 1. Tibo also said he spent $100,000 on a window-related project, found the process extremely chaotic with too many choices and constraints, and that about 80% of people he met in that field do not really use AI or only try ChatGPT's free tier randomly; he said if starting over he would enter a physical business, make it AI-native and prepare for a robotics revolution 2.
2. Tw93 said Kaku added remote use: running kaku remote on a Mac generates a link that can be opened in any browser on another computer or a Pad to operate that home Mac's Kaku, with full-screen browser use suggested for people whose home Mac is powerful and who need remote access while away 1. Kaku also supports typing "# + natural language" in the terminal to generate executable commands: an escape sequence hands the sentence to a Lua script inside Kaku, the Rust layer requests the model, and Lua writes the generated command back to the command line; the author advocates choosing the most suitable language per scenario and says such coding problem-solving scenarios are decreasing in the AI era, though knowing language traits still helps when AI goes off track 2. He described mixing languages in client development: six years ago he used JavaScriptCore to run JS for Markdown formatting in his Swift Mac Markdown app Miaoyan; for the Rust desktop packaging tool Pake he had Rust call JS to render notifications in the web layer and the web side call back into Rust for system capabilities; Miaoyan's split-pane editor uses the open-source C library cmark-gfm to parse Markdown, with the preview JS reading line markers and notifying Swift through a message channel to sync scrolling 3.
3. Jon Yongfook published a fictional product, Migraite, claimed to instantly deploy a "CTO robot swarm" to migrate SaaS products to whichever tech stack was not breached that week, with monitoring and one-click migration, priced from $2,000 per month 1. He criticized AI design tools for adding a small monospace pre-title before the formal heading, calling it an obvious tell of AI-generated content and "the em dash of UI design" 2. He listed four parallel product lines: an existing SaaS, a long-horizon freemium mass product, a short-horizon high-priced niche product, and a traditional enterprise product driven by outbound sales, calling it diversification 3.

3. Hardware and Market Data

1. China's consumer 3D-printer exports rose 90% year over year in the first half, and Chinese companies' global market share climbed from 19% to 96% over the past decade, according to the relayed report. Creality, Anycubic, ELEGOO and Bambu Lab lead on price and scale, with prices down to about $500; Bambu Lab's valuation was reported at about $10 billion, and Creality listed in Hong Kong in May. The industrial segment still faces trust barriers with European and US vendors, plus intellectual-property disputes and price wars 1.

4. Disputed/Unverified

1. disputed/unverified — A relayed account said the security vulnerabilities were "probably about it" and expected no more to be found 1. This conflicts with the broader picture painted by other posts of an ongoing wave of AI-assisted vulnerability discovery and patching 2 3 4; the claim is a single account's expectation, not a verified count.
2. disputed/unverified — @levelsio said opponents of his views on European low-quality immigration are almost all anonymous accounts with no avatars, likely foreign hostile bot accounts spreading divisive rhetoric to destabilize Europe and the West 1. This is his assertion; the material provides no independent verification of the account identities or coordination.