A quiet weekend on the AI-lab front: nothing new shipped in the last day from the model labs, harnesses, or the usual technical authors. What did move is security research worth a patch-check: new findings that a single compromised machine on a Tailscale network with SSH port forwarding enabled can reach root on every server it’s allowed to talk to, and fresh proof that the PHP2Shell bugs are being run by what looks like an agentic attacker against a government target.