Zero-day speed, local agents in Open WebUI, and readable PRs with one trick

Important AI news

PHP hole shows new zero-day speed

A security firm found a severe PHP flaw using an OpenAI model. Attacks started before the fix was public. Google’s incident response team says median time to exploit is minus seven days. One week after disclosure, over a quarter of the 14 million exposed services in the US were patched. In China it was 4 percent, says Censys. Zero-day. That means an unknown, unfixed vulnerability. You need shorter response paths. You map where PHP runs, how patches get applied, and who is reachable for urgent fixes. The usual disclosure rules (coordinated vulnerability disclosure, a researcher reports internally, then publicly) are under pressure.¹

Open inference grows, numbers stay fuzzy

Measurements of open models’ market share are rough. The Interconnects author bundles available signals and warns about noise. Fireworks reported 40 trillion tokens per day this week for custom models as a subset. The total is likely much higher once other verticals roll in. These are vendor numbers. For planning, budget open and closed models separately and price in uncertainty.²

China builds hyperscalers fast, cheap, and different

SemiAnalysis visited a campus in Ulanqab with up to 800 MW IT capacity. The first 120 MW came within a year at about a fifth of US costs. An 800 V DC path with solid-state transformers skips classic AC stages. The report says about a quarter of newer Chinese data centers run on DC, while around 97 percent in the US still use AC UPS. Cooling drops central chillers and serves air- and liquid-cooled servers in a loop. If you procure data center capacity, ask directly about topology, power path, and water use.³

Highlights for your day-to-day

• Open WebUI 0.13.1 brings coding agents into the model picker and Tether as a desktop companion. Tether connects your machine to Open WebUI so agents can access real files, repos, and tools without opening ports. Also new: cheaper tool chats through less prompt overhead and an optional auto-approve for tool calls via a review model. 0.13.3 adds automations with agents and more usability fixes.⁴⁵
• Make PR descriptions more readable. Put the long text generated by agents in a collapsible details/summary. Above it, write two human-made sentences with the gist. This works directly in GitHub Markdown and saves review time.⁶
• What holds up from Stanford’s AI-native course in teams: patches land in real open source repos, maintainers review. For your next PR, use Geoffrey Litt’s explain-diff skill as an idea. Get the diff explained and quizzed before you ask for review. Monaco bought code review and built agent-ready workspaces in-house. Mihail Eric’s rule: Buy to learn, build to keep.⁷

Tools and updates

• Phonon TTS: high-quality speech synthesis directly on device. For voice features in apps or service assistants without server audio. Requirement: on-device deployment.⁸
• Confucius4-R2T2: streaming ASR with a stable prefix that no longer changes earlier tokens. Useful when agents react live to every word and should avoid revision errors. Based on a paper, not a product launch.⁹
• WhatsApp Events: create events, invitations via link, also for people without a WhatsApp account. A new Events home bundles invites and RSVPs. Rolling out in the coming weeks.¹⁰

Try it in five minutes

A small exercise for reviews without new tools.

1) Copy this sample diff into your usual AI chat and ask: “Explain the change step by step for reviewers. Ask me three control questions at the end.”

diff --git a/invoice.py b/invoice.py
@@
-def calc_total(items, tax_rate=0.19):
-    subtotal = sum(i["price"] * i["qty"] for i in items)
-    return round(subtotal * (1 + tax_rate), 2)
+def calc_total(items, tax_rate=0.2):
+    subtotal = sum(i["price"] * i["qty"] for i in items if i["qty"] > 0)
+    return round(subtotal * (1 + tax_rate), 2)

2) Answer the questions yourself in bullet points. Add a risk note if the tax rate changes or negative quantities were expected before.

3) Result and check: You can say in two sentences what changed and who is affected. You find at least one test that must be updated.⁷

Sources

1. China in the Cyberpocalypse (chinatalk.media)
2. How well can we measure open model inference share? (interconnects.ai)
3. We Visited China’s Stargate in Inner Mongolia (newsletter.semianalysis.com)
4. Open WebUI v0.13.1 (github.com)
5. Open WebUI v0.13.3 (github.com)
6. Hide your slop PR descriptions behind <details><summary> (simonwillison.net)
7. How Stanford Teaches AI-Native Engineering — Mihail Eric, Monaco (latent.space)
8. A Closer Look at Phonon TTS. Launching High-Quality On-Device Speech That Tops the Benchmarks. (huggingface.co)
9. Paper: Confucius4-R2T2: A Stable-Prefix Streaming ASR Model for Real Real-Time Transcription (huggingface.co)
10. WhatsApp Events Brings People Together Beyond the Group Chat (about.fb.com)