AI finds Linux kernel exploits & PHP2Shell and AI-driven security - Hacker News (Nov 5, 2026)

For roughly 1.2 million dollars in API credits, an AI system produced nearly a thousand working exploits that let an ordinary user take full control of a Linux machine. We'll get to what that means for software security in a moment. Welcome to The Automated Daily, hacker news edition. The podcast created by generative AI. I'm TrendTeller, and today is November 5th, 2026. On the menu: AI-powered vulnerability hunting, a huge new open-weight model, a long-awaited upgrade to Go's JSON handling, activists who got a city to adopt their bike lanes, and a mystery about where the moths went.

AI finds Linux kernel exploits

Let's start with that headline. OpenAI says it has built an autonomous security research pipeline that discovers, validates, exploits and even patches Linux kernel vulnerabilities, all inside a controlled environment. In a single campaign, the system flagged more than two thousand candidate issues and reproduced most of them. It produced 948 working local privilege escalation exploits, meaning an unprivileged user could become root. The bill was roughly 1.2 million dollars in API credits. Human researchers reviewed the findings before passing them to kernel maintainers, and the system also suggested candidate fixes. OpenAI's main argument is that finding bugs is no longer the hard part. The real bottlenecks are now deciding which bugs matter most, confirming them and getting patches shipped. The company also says the work turned up new Linux exploitation techniques, which makes a strong case for defense in depth and faster hardening.

PHP2Shell and AI-driven security

That ties directly into a story we've been following. IEEE Spectrum now argues that the PHP2Shell vulnerability is an early warning of how AI is changing cybersecurity. The new detail is how the flaw was found. For years it looked like a harmless out-of-memory crash, until researchers used AI tools to work out how to turn it into arbitrary code execution. The piece warns that AI helps skilled defenders and attackers alike reason through messy legacy code, and that this brings decades of technical debt to the surface. Its recommendations are more funding for defenders, better AI-assisted auditing and stronger formal verification tools. For everyone else, the advice is simple: install security updates quickly.

Kimi K3.1 Pro open-weight model

Over in model land, Moonshot AI has released Kimi K3.1 Pro, an open-weight model that handles both text and images and the first entry in its K3.1 series. It's built for agentic work, meaning tasks where the model plans and takes multiple steps on its own. It's enormous, at nearly three trillion total parameters, although only a small fraction is active at any moment thanks to a mixture-of-experts design. It also offers a one-million-token context window for very long documents and codebases. Moonshot highlights gains in coding, 3D creation, financial research and factual accuracy, and its benchmark tables are competitive with top models. Releasing a model of this size with open weights keeps up the pressure on closed labs.

OpenAI Images 2.6 adds GIFs

OpenAI also shipped Images 2.6 across ChatGPT, Codex and its API. The company says generation is about fifty percent faster and that characters, products and brand details stay more consistent across multiple rounds of edits. The most noticeable addition is GIF animation, which is useful for reaction images, mascots and quick storyboards. Developers get extra controls, including SVG export and a setting that trades scene detail against speed. The broader direction is clear: image tools are moving from one-off pictures toward workflows people can actually use in production.

Go 1.27 ships JSON v2

For the programmers: Go 1.27 now officially includes a new generation of JSON packages in the standard library, after a period as an experiment. The original encoding/json package had well-known problems. It quietly accepted invalid text encoding and duplicate keys, matched field names in surprising case-insensitive ways and hit performance limits. The redesign splits low-level JSON parsing from the higher-level mapping to Go types. It also processes data as a true stream instead of loading whole values into memory first. The API should still feel familiar to Go developers. JSON runs through a huge share of Go software, so stricter defaults and better speed will reach almost the entire ecosystem.

Guerrilla bike lanes in San Francisco

Now to the streets of San Francisco. After two cyclists were killed in hit-and-run crashes near Golden Gate Park, an anonymous group calling itself the San Francisco Transformation Agency installed its own protected bike lane posts. Unauthorized street changes like this are usually removed quickly. This time, the city said it would install official posts and leave the activists' version in place while it reviewed the area. Similar guerrilla efforts in Seattle and New York got mixed reactions. Here, the stunt seems to have sped up changes the city was already open to, given the miles of protected lanes it has built recently.

Why LEDs stopped attracting insects

Finally, a small nature mystery. Have you noticed fewer bugs swarming around porch lights? The likely reason is LEDs. One writer noticed that after a family in Mexico switched to LED bulbs, the insects disappeared from their outdoor dining area, and so did the geckos that used to hunt them. Research suggests insects navigate partly by moonlight cues, and the ultraviolet light from older bulbs confuses them and pulls them toward lamps. LEDs give off little or no UV light, so many flying insects simply ignore them. That could mean less disruption to wildlife and possibly less spread of some insect-borne diseases. LEDs still raise other concerns, though, such as the effect of blue light on circadian rhythms.

That's all for today. AI is reshaping security, open models keep getting bigger, Go's JSON support finally got its overhaul, and sometimes a few plastic posts can push a city to move faster. Links to all stories can be found in the episode notes. I'm TrendTeller, thanks for listening to The Automated Daily, hacker news edition. See you tomorrow.

AI finds Linux kernel exploits & PHP2Shell and AI-driven security - Hacker News (Nov 5, 2026)

Our Sponsors

Today's Hacker News Topics