Build your brief

● ReadKernel

Today's brief

10 stories worth your time.

1. 1. Tech

   UK allocates £100m to new AI Biosecurity Lab with OpenAI and Anthropic support

   The UK government announced an AI security budget of $800 million, earmarking £100 million for a new AI Biosecurity Lab and £65 million for pathogen countermeasure development. OpenAI and Anthropic are contributing up to £200 million combined, and the lab is described as the world’s first dedicated AI biosecurity organisation. The initiative aims to use advanced AI to detect biological threats and accelerate vaccine development.

2. 2. Tech

   OpenAI stops live‑web access for training its frontier AI models

   OpenAI announced it will no longer use live internet data when training its most advanced models, switching to a cached copy of the web. The change follows a recent security incident where a research model accessed the internet due to a configuration error, prompting a pause and a security overhaul. The company said the decision is based on the current state of alignment research and internet infrastructure security.

3. 3. AI

   Moonshot AI launches 3‑trillion‑parameter Kimi K3.1 Pro with weights due Nov 4

   Moonshot AI released Kimi K3.1 Pro, a 3‑trillion‑parameter open‑weight model with a 1‑million‑token context window and a high‑speed variant that is 2‑3× faster. The model scores 55 on the Artificial Analysis Intelligence Index, an 11‑point gain that places it fourth behind three Anthropic and Meta models, and it nearly matches Claude Opus 5.5 on a coding test. Moonshot will publish the model’s weights by 4 November 2026 and has removed hacking‑related training data to limit misuse.

4. 4. Tech

   Critical PHP bugs threaten widespread web services

   Two critical bugs were discovered in the PHP programming language, which powers the majority of internet sites, and they threatened to upend the internet. Experts say fixing the flaws is not as simple as clicking “Update” and advise assessing risk and taking protective steps.

5. 5. Security

   BlackX UEFI bootkit exploits Baton Drop flaw to bypass Secure Boot in Central Asian diplomatic targets

   A UEFI bootkit called BlackX, observed in early 2026, leveraged the Baton Drop vulnerability to bypass Secure Boot and load a malicious driver that interferes with Kaspersky and Avast security solutions. The campaign targeted diplomatic organizations in Tajikistan, Uzbekistan and Turkmenistan and is attributed to the China-linked APT41 group.

6. 6. Security

   Eye Security disables vulnerable Time4Popcorn updater affecting millions of PCs

   Researchers remotely disabled the updater in the abandoned Time4Popcorn app, a Popcorn Time fork, closing a flaw that could have let attackers execute code with elevated privileges on millions of computers. Between November 2025 and March 2026 the Dutch firm Eye Security pushed more than 2 million updates to devices it did not own to switch off the background updater that could have been used to take over machines.

7. 7. Startups

   AI-detected bug reveals major PHP vulnerabilities, FBI warns

   Researchers using AI identified significant security flaws in PHP, the scripting language that powers most websites. The language’s governing organization and the FBI’s cyber division issued a warning on Wednesday, prompting government agencies, corporations and other entities to assess exposure.

8. 8. AI

   Microsoft Research open-sources Agensh multi‑agent harness scaling to 1,024 agents

   Microsoft Research released the Agensh harness as open source. The system operates without a central orchestrator, letting self‑organizing workers share a Git repository, chat, and a findings board. It can scale from a single agent to 1,024 agents on ProgramBench within a six‑hour budget.

9. 9. AI

   Cognition open-sources Devin Vulnerability Fixes plugin for PHP, Node.js, GitLab

   Cognition released the Devin Vulnerability Fixes plugin, which includes three MIT‑licensed agent skills. The skills inventory, patch, and test PHP, Node.js, and self‑managed GitLab deployments affected by recent critical RCE flaws, and automatically open one pull request per repository. The plugin is offered as an open‑source agent plugin.

10. 10. Developers

    Developer releases PHP RCE demo titled “Steal My Bitcoin”

    A Show HN post titled “Steal My Bitcoin” demonstrates a PHP remote code execution exploit the author built out of curiosity. The post has attracted 440 points and 264 comments on Hacker News.