AI exposes a major web security flaw, plus a new kind of voice model
This week's panel examines a critical PHP vulnerability that AI tools are surfacing faster than organizations can patch, a voice model from Block that listens and speaks simultaneously, and a cultural riddle benchmark that exposes how evaluation rewards guessing over admitting uncertainty. The episode closes with an IBM TechXchange report on streaming data architecture for AI agents.
The PHP Vulnerability and the Fragility of Legacy Infrastructure
The week’s most consequential story is PHP2Shell, a critical flaw in a language that underpins roughly 70% of websites. Security firms found the vulnerabilities while AI systems were probing PHP for weaknesses, and the discovery highlights a shift in the economics of security: AI can now find and exploit flaws faster than organizations can patch them.
The exposure is serious because PHP is not a product that can be updated on its own. It is a foundational language, and an attacker who achieves remote code execution on a PHP server can reach attached databases, internal network segments, and stored credentials. Ash Minhas described it as having the keys to someone else’s hotel room long after you should have checked out. Defenses that large enterprises rely on, such as segmenting servers into a DMZ or placing web application firewalls in front of them, do not stop this class of attack. Smaller businesses and individuals running PHP sites often lack that architecture and are, in Minhas’s words, sitting ducks.
Maintenance, Open Source Funding, and Disclosure
Jessica Nahulan framed the problem as a mindset change. Many organizations built websites, deployed them, and moved on, treating them as finished. AI has changed that calculation: teams now have to revisit old stacks, examine dependencies, and ask whether a component is maintained by a single developer who patches once every two months. Modernization, once a “nice to have,” has become mandatory so that patches can be applied without breaking the infrastructure beneath them.
The disclosure timeline exposed a deeper imbalance. Two firms, Wiz and another group, independently directed AI systems at PHP that summer and converged on the same flaws. They then coordinated with the PHP Foundation, the body that maintains the language, which, despite stewardship of code behind most of the web, has one full-time employee. Minhas argued that the open source ecosystem depends on an assumption that someone else will handle maintenance, and that consumers of open source must start investing back into it in time, money, and engineering resources. Otherwise, the gap between discovering a vulnerability and fixing it will keep widening.
Legacy Code and the Layers of Abstraction
The conversation widened into a broader reflection on how software is built. PHP was created in 1994 by Rasmus Lerdorf, who reportedly joked that he was not a real programmer and wrote the tool to avoid writing code for his personal homepage. It now underpins a large share of the web, a fact that raises the question of how much of the digital infrastructure rests on improvised foundations.
Minhas pointed to layers of abstraction as the core issue. Developers import libraries and dependencies without understanding what they do, where they came from, or whether they can be trusted for the next task. Nahulan noted that real rearchitecture of 30-year-old systems is rarely pursued because of timelines, resources, and maintenance pressure, so teams stack patches on top of brittle foundations. Her counterpoint was that AI also offers an opening: rewriting and understanding code whose original authors are long gone is now far easier. The result, she argued, is that vulnerabilities are being found faster than ever, but so are the fixes.
Dessa: A Voice Model That Listens and Talks at Once
Block, the company behind Square and Cash App, unveiled Dessa, a model trained only on spoken conversation, with no text in its training. That distinguishes it sharply from text-trained large language models. The most notable capability is full duplex operation: it can listen and speak simultaneously rather than waiting for the user to finish. Judith Aquino pointed to demos in which it interrupts and responds with backchannel cues, and Minhas noted that linguists call such signals backchanneling. Producing them gracefully is a significant technical feat that depends heavily on the audio training data.
The panel was clear about how little is known. There is no paper, no published methodology, and no public release, only a demo website. Block did mention a duplex benchmark but shared no scores.
Skepticism About Knowledge and Evaluation
Minhas argued that training without text implies a narrower base of world knowledge, since conversational data alone is a thin substitute for the breadth of written material. He expected the model to hallucinate considerably because it lacks grounding. The more pressing question for him was evaluation. Established benchmarks such as MMLU and coding tests have no obvious audio equivalent, and open questions remain around controllability and hallucination.
Aquino admitted to being impressed by the first real duplex agent she had heard, but she shared the concern that a model trained on conversation alone would lack accuracy and reliability, the qualities teams use to select models. She also suggested that the hallucinations might add something like the variability of a human personality. Her larger point was that interruption and conversational timing create a new set of criteria. Accuracy alone does not capture whether a system knows when to jump in, when to stay quiet, and how to handle the nuances of human speech and the noises people make. Grading such behavior requires new evaluation frameworks.
Cultural Riddles and the Problem with How Benchmarks Reward Guessing
A new benchmark built around culturally specific riddles tests whether models can interpret meaning that depends on context. The riddles draw on the same kind of metaphorical language that makes classic puzzles hard, such as the Sphinx’s riddle about walking on four legs, which requires rethinking what legs and times of day mean. Models trained predominantly on English and Western text, and on the internet’s skewed sample of the world, are likely to stumble on riddles rooted in other cultures. Minhas noted that the researchers offer an online quiz, on which he reported scoring around 80 percent.
Benchmarks That Reward Confident Guessing
Minhas used the riddle study to make a broader critique of how models are evaluated. Standard benchmarks award a point for a correct answer and none for an abstention, so a model is incentivized to guess rather than say it does not know. He illustrated the point with a birthday question: a random guess has a one in 365 chance of being correct, which beats an honest “I don’t know” that scores zero. Benchmarks that penalize confident errors or credit calibrated uncertainty would better reflect real reliability. He also observed that culture is a moving target, which makes it hard for training data and model updates to keep pace.
Nahulan drew a different lesson from the study, linking it to remarks by Tim O’Reilly at IBM TechXchange about words as compressed representations. A short prompt such as “write me a PRD” expands into a complex structured document, and what that acronym means can vary from company to company and culture to culture. The implication is that prompts carry context, and understanding the languages and audiences a model serves is essential.
IBM TechXchange: Data Architecture for the Agent Era
IBM Field CTO for data Kio Gabriel reported from IBM TechXchange in Atlanta, describing a shift in the AI conversation from hype cycles (vector search, retrieval-augmented generation, model training, then agents and coding assistants) toward the maturation of older disciplines. Agent identity, orchestration, process management, and monitoring are long-standing ideas, but agentic systems change how they must be implemented.
Gabriel introduced Streamhouse as a name for an architecture that the largest technology companies have used for years to handle streaming data at scale. Data lakes hold everything without structure, warehouses hold structured archival data, and lakehouses attempt to combine both while separating compute from storage. Streamhouse extends that by bringing operational, real-time processing into the picture, using streaming frameworks such as Flink so that agents can act on fresh context. He tied this to IBM’s acquisition of Confluent, which was meant to keep data moving to where agents need it.
Why Streaming Is Becoming Practical
Gabriel’s central argument was that streaming architectures were historically hard to build, particularly stateful stream processing, and most developers defaulted to request-response designs. AI changes that equation in two ways. Agents generate far more data exhaust, pushing organizations that once had modest data needs into territory that demands this class of platform. At the same time, AI can write and rewrite stateful stream processing jobs, lowering the barrier that kept most teams away from streaming.
He also highlighted identity as an example of an old problem taking a new form. Autonomous agents are not people, and their numbers can be orders of magnitude larger, so they need very short-lived credentials and careful access control. Gabriel also described how AI may help bridge the historical divide between the teams that build systems and the operators who run them, since both can now see how software uses underlying infrastructure and where problems arise.