AI Just Broke The Internet. For Real This Time.

AI news this week: It's the AI Cybersecurity apocalypse. Maybe. AI-found PHP flaws pushed governments to take websites offline, Railway got hacked and US banks are finding rogue AI agents inside customer accounts.
On today's AI For Humans, Kevin Pereira and Gavin Purcell dig into the wildest cybersecurity week in years. AI helped surface bugs that sat inside PHP (which runs a huge chunk of the web) for years, governments told everyone to patch now or pull the plug, and Cloudflare's CEO says exploit attempts hit the millions. We break down what you actually need to worry about and how to keep your vibecoded lil apps from draining your accounts. (Short version: def don't hand your agent your bank login.)
Also: the fun side of AI hacking. People are using Claude Code to vibecode their smart TVs and rip out the bloatware. In Good News / Bad News, Anthropic finds small AI models may soon copy themselves onto cheap gadgets (yes, even your smart fridge), while Claude helps with scorpion antivenom research.
Plus: Unitree's H2-X kung fu robot, Flux 3 Max, Wan 3 vs. Seedance 2.5, Claude Duet, Gavin's Higgsfield mini-rant, ASCII Mario Kart, Machine Gods (the new Kevin Roose and Casey Newton podcast) and more.
PLEASE UPDATE YOUR PHP. WHATEVER THAT IS. JK WE KNOW. REALLY.
// Chapters //
00:00 AI Is Now Powerful Enough To Hack The Planet
01:52 The PHP Vulnerability Meltdown, Explained
05:43 How AI Found The Bug & Why Exploits Hit 1M+ Attempts
10:03 Should AI Slow Down? The New Cybersecurity Arms Race
15:30 Rogue AI Agents Are Inside Bank Accounts
17:04 People Are Vibecoding Their Smart TVs With AI
25:53 Unitree H2-X Kung Fu Robot & Jensen's Tiny Robots
33:16 Good News / Bad News: Self-Replicating AI & Scorpion Antivenom
35:58 Flux 3 Max & Wan 3 vs. Seedance 2.5: AI Video Tools
40:31 Claude Duet: Anthropic's New Proactive AI Agent
43:58 Higgsfield Goes Mainstream: Gavin's Mini-Rant
47:16 AI See What You Did There: ASCII Mario Kart & New Game Ideas
// Show Links //
Critical PHP vulnerabilities: update your systems now (NBC News)
https://www.nbcnews.com/tech/security/critical-vulnerabilities-php-update-systems-rcna604751
How the PHP flaws were found and fixed (The PHP Foundation)
https://thephp.foundation/blog/2026/10/21/todays-php-security-release-and-how-were-strengthening-php-security/
Railway's security disclosure
https://blog.railway.com/p/security-disclosure-wednesday-october-21st
People are legitimately freaking out
https://x.com/stuhlmueller/status/2110048778942284149
Banks are finding unauthorized AI agents in customer accounts (Axios)
https://www.axios.com/2026/10/22/ai-agents-banks-unauthorized-accounts-access
People are using AI to make their smart TVs dumb again (TechCrunch)
https://techcrunch.com/2026/10/19/people-are-using-ai-to-make-their-smart-tvs-dumb-again/
Ten good examples of vibecoded TVs
https://x.com/Azadux/status/2112392016248324286
A really good TV hack walkthrough
https://x.com/JoshDaws/status/2112300013212623079
A pocket device, hacked and improved
https://x.com/eduardfausgil/status/2112342282343223655
Wes Bos's Amazon photo frame dashboard
https://github.com/wesbos/photo-frame-dashboard
Unitree H2-X Kung Fu Legend Guardian
https://x.com/UnitreeRobotics/status/2112819774573179175
Unitree H2-X on YouTube
https://www.youtube.com/watch?v=Y3zb4o47yqA
Jensen telling little robots where they came from
https://x.com/NVIDIARTXSpark/status/2112952375929397595
Anthropic: AI models may be able to self-replicate without a datacenter
https://www.anthropic.com/research/self-replicating-ai
Claude helps design a scorpion toxin binder
https://www.anthropic.com/research/claude-scorpion-toxin-binder-design
Flux 3 Max
https://x.com/fal/status/2112251022047412492
Gavin's Flux 3 Max test
https://x.com/gavinpurcell/status/2112605551272288575
Flux 3 Max keyframes to video
https://x.com/AIWarper/status/2113107375272161405
Gavin's Wan 3 vs. Seedance 2.5 test
https://x.com/gavinpurcell/status/2113119269160718641
Claude Duet
https://x.com/c...