TBPN - Cybersecurity Red Alert, SpaceX Earnings, OpenAI Strikes Google Deal | Diet TBPN

Episode Date: October 21, 2026

Diet TBPN delivers the best of today’s TBPN episode in 30 minutes. TBPN is a live tech talk show hosted by John Coogan and Jordi Hays, streaming weekdays 11–2 PT on X and YouTube, with each episode posted to podcast platforms right after.Described by The New York Times as “Silicon Valley’s newest obsession,” the show has recently featured Mark Zuckerberg, Sam Altman, Mark Cuban, and Satya Nadella.TBPN is made possible by:Ramp - https://ramp.comPublic - https://public.comCisco - https://www.cisco.comConsole - https://www.console.comCrowdStrike - https://www.crowdstrike.comFigma - https://www.figma.comMongoDB - https://www.mongodb.comNYSE - https://www.nyse.comRailway - https://railway.comShopify - https://www.shopify.com/Follow TBPN: https://TBPN.comhttps://x.com/tbpnhttps://open.spotify.com/show/2L6WMqY3GUPCGBD0dX6p00?si=674252d53acf4231https://podcasts.apple.com/us/podcast/technology-brothers/id1772360235https://www.youtube.com/@TBPNLive

We got bad news for you, and then we have good news. The bad news is John is not here with us today. He is under the weather. Keep him in your thoughts and prayers. We've never actually taken sick days ever. Normally when we're sick, we just keep going. But John is really down and out. And we feel like a ship without a sail.

Yeah. A lighthouse without a light. And we miss him dearly, but the show must go on. We have a great show. I got big shoes to fill. Huge shoes to fill. John is wearing all of John's clothing. He put his clothes.

Trying to keep it together. But funny enough, this suit doesn't actually look as comical as one might think. I was hoping that it would look even more exaggerated. It kind of just looks like a normal suit. Not a workout-related illness this time. Just flu season. So stay safe out there. But big day today in technology.

Of course, all the new vulnerabilities that we're finding out about, which are unfortunate, was texting friends and family this morning, trying to make sure that everyone outside of X is well aware. But we have Nikesh Aurora coming on in just 30 minutes from Palo Alto Network. He's going to break it down. Going to break it down for us. So, yeah, we'll cover a few things, but wait to get into a lot of it with him. And then we have Aidan Smith from flapping airplanes coming on. They have a new $800 million round.

And before I forget, let me tell you about Ramp. Time is money, save both. Easy-use corporate cards, bill payments, accounting, and a whole lot more. You nailed it. You just missed the button. Yep. But we're working through it. Yeah.

We're having some technical... There it is. There it is. We're having some difficulties here. Yeah. I'll figure it out as the show does. John makes it look so easy. Yeah.

Makes it look so easy. But it's in our form, right? It truly is. Yeah. It really is. Some of the stuff you can't even really be taught it. It's just kind of natural, I think. Totally. You're born with it. Yeah. Well, let's pull up this video of John shortly before coming down with an illness. Wow. Wow.

Season got started and he wasted no time clip farming. Majestic. I hope he's watching this. I think he's sleeping. Anyways, let's go into Ph.P. Land. You want to kick it off? Yeah, I mean, so, PhP, obviously, like everyone knows, right, as you do. You know. Sorry. So something like 70% of all websites run on PHP.

And basically there's this big vulnerability that was found in August. And now it's kind of coming out. There's a patch coming out. It should be, I think it may have just come out. It didn't come out immediately when the actual news of the vulnerability happened. Yeah, so this was discovered with 5.6. Yeah. Back in August.

And so for the last couple months, all the different companies involved have been trying to inform as many as people as possible. Yes. Trying to make sure that a lot of companies can get ahead of this before the disclosure. The big issue, I mean, my personal point of view is like you're probably going to be fine using services from public companies, right? Companies that would have been in the loop over the last couple months. The bigger issue is the rest of the Internet websites that people have been. Yeah, I think there's going to be this kind of long tail of people that. you know, maybe are not that online, but they, you know, they're running their own server from

their, you know, local business that they've had up for 20 years or something. I think that's a scenario that, like, is maybe a little bit more scary where you just like have to really stay up on this stuff. Yeah, I've been thinking about, like, all the different places that people have input private information, things like social security numbers. I'm thinking like old, even like local government websites, right? All these different things. It feels like we're very close to or effectively it's unavoidable that a lot of this stuff is going to leak out. So that's the bad news. Yeah, we've seen a lot of government websites like temporarily come down.

I think Finland, they had some internet services that they like just took offline. Yeah, took offline. Netherlands, France, similar. But hopefully, you know, throughout the day, those will come back up because it seems like the main patch has now come out. So the issue dubbed Ph.P.2 Shell represents a class of problems in the way P.HP manages a computer's memory. It can be exploited in many ways, some requiring just a few seconds, by hackers who would use it to run unauthorized software on any unpatched web server.

It is the most severe security issue that PHP has faced in more than a decade. According to Volker Dush, a security engineer with a nonprofit foundation that manages the Ph.P. Project, he likened it to Heartbleed, a similarly widespread vulnerability that forced a global race to protect hundreds of thousands of servers more than a decade ago. When security patches are released, it marks the starting shot in a race between defenders and hackers. Defenders have to test and install the software patches while hackers study the patches as a guide to find new vulnerabilities, looking to see what has changed and then devising ways of attacking those areas. But today's AI tools can do this work much quicker than any human, potentially making the process

more risky, security experts say. Some dude on Twitter could take the patches and run AI against it and post some exploit script, said Ty, the chief executive of Caliph, the security company, that first discovered the issue. All hell will break loose. Is that good? The big bug. Ryan Austin, a researcher at Caliph, uncovered the flaws with help from GPD5.6 Seoul, one of OpenAI's most advanced models from a couple months ago. During an audit of PHP source code in August, OpenAI funded that and other audits, part of an effort by AI companies to help open source projects address software vulnerabilities now being uncovered by

AI systems. The class of bugs had been hiding in PHP source code for years. Security researcher had flagged it as a problem area decades earlier, but the flaw had been considered too difficult to exploit and was largely forgotten. AI found a way. Austin figured out how to control the code that was running in the computer's memory with as few, with as a few dozen requests to a server running PHP. On smaller system, the hack takes just seconds. A more complex one, it can take hours. On August 11th, Dung, called PHPs. Leadership, there's a serious issue here, he said. I had this moment of, oh, God, what are we doing now? Dush said, how do I communicate this? And then you calm down. You let the adrenaline flow through, and you get to fix it. Soon an informal working group

had formed among security researchers and software engineers. They collaborated with software distributors and security companies figuring out ways to patch PHP 2 shell and prevent it from being exploited. Researchers from Google's with cybersecurity team soon reached out with new exploits, which they had discovered independent of Caliph. They were findings from OpenAI's research team to. AI is enabling well-meaning security researchers to find thousands of software bugs, overwhelming projects like PHP with a flood of issues that need patching. But PHP 2 Shell was viewed as a priority and AI's proficiency at hacking prompted worries that criminals could exploit PHP 2 Shell. We need to figure out how to, we need a like a nickname for that.

It's getting a little long. I'm a heart bleed that other... Yeah, that name goes heart. PHP2 Shell doesn't sound very scary. Yeah, it just sounds like some mumbo-jumbo. Keeping the secret. PHP2 Shell is the most severe AI vulnerability that was ever found and one that was likely too complex to have been discovered without AI,

said Ami Lutwok, Wiz's co-founder. Dung and the other researchers kept its existence a closely guarded secret while they worked on fixes for fear that an AI-aided hacker might find and exploit it before they were done. Really crazy that this was kept like a relative secret for this. Yeah, well, actually, I think the original release of this was supposed to be tomorrow, and then details started to leak, I think, a day or two ago. And so actually they pushed it out.

Right at the very end, it started to leak. But, yeah, while they were working on it, it is, it's great that they were able to kind of hold on to this. The patching effort was massive. There are close to 200 files being fixed, and developers wrote over 10,000 lines of code during the process. Should have called Gary Tan. He could have ripped that 10,000. He stack could have done that in a day. In a day.

Maybe hours. Eventually, a patch was set October 22nd. Then the inevitable happened. News of the patch leaked out Tuesday in a post in Hacker News, fitting for it to go out on a site called Hacker News. Greg Brockman had a good post about this. One interesting kind of tidbit that people are pointing out, I can read it here. As vulnerability discovery ramps, we will need new defense solutions, potentially including authorized defenders such as government, scanning the internet for vulnerable hosts in either notifying or in extreme cases patching those systems remotely,

which is very interesting. I mean, you can imagine some kind of service that basically, they just, whenever anything happens, they are like have some side of, you know, right access into your systems and can update them. Yeah. Prime Minister posted, we have an urgent request for everyone to take action regarding PHP, which is used on many websites. The PHP security team has issued a warning about two critical vulnerabilities. check if you have publicly available websites that use PHP and prepare to apply the fix patch

that will be released tonight at 11 p.m. Japan time. It is difficult to apply the fix promptly, temporarily suspending websites and similar measures can be considered an effective way to reduce risk. And Levels I.O. reached out to a friend. He said, I notified a friend working at a big tech company about the PHP vulnerability as their entire infrastructure runs on PHP. He answered, thanks, I'll try to patch it in a few days as I'm out of office now. And this is the modern tech company. Imagine the traditional company is running PHP. People won't update fast enough and the vulnerability will be out in the wild. Once the patch hits, as anyone can reverse engineer it based on the patch. Considering this, there's going to be so many sites hacked and so

much user data exposed, I think. So, yeah, not great. Also, I mean, we haven't covered this yet, but there's actually two probabilities. There's a second one from eMudra, which is basically the TLS certificates, right? You know, that has the little lock on the browser. Some of them had, like, very trivial private keys. I think one of them was literally just number four. And so, you know, for contacts, the private keys are supposed to be, I think, hundreds of digits long, these, like, you know, numbers,

and it's just number four. Not great. It is fascinating, though, that... But no one would expect number four. That's true. I looked up, I think that had been, like, live for, like, a year and a half. And no one, seemingly no one, like, really did anything with it. So maybe it kind of a white pill,

Yeah, no one expects the number four. It's actually the smartest possible thing they could have done. Yeah. The most secure. Opening I released a codex skill to help check whether your website is affected. They point your codex at a GitHub repo that was just created and it will guide you through it. So check that out or use your favorite agent.

Moving over to updates on Trevor Milton's new Jet startup. I don't even know if it should be called a startup just because it's a startup just because the company has been around for decades at this point. But a friend of the show, Preston Holland, was able to actually go to the event. I was quite bearish on this strategy. Trevor Milton's obviously been pardoned. It doesn't have a record anymore. He's free to do and build whatever he want.

I just think the strategy of... So he did nothing wrong. I'm not going to say that. Definitely not going to say that. But he is a free man. And again, I think the strategy of going into private aviation where you have super discerning buyers is just not. probably a good business strategy.

I still think you can make some argument where, you know, there's some kind of stigma discount that you can get on the plane because, like, if other people are worried about buying from him, that's a buying opportunity for me, right? Others are fearful. Buy when others are fearful. So I think this could, you can, there's some argument here. I think it makes sense. I think that that's typically about investing, not, you know, relying on a machine for, you know.

These are investments, you could say in a way. Right? Yeah, it depends on how much you value your time versus your life. But anyways, Preston got a good picture at the launch. The wings of the plane were propped up by posts. So is that normal? No, maybe this is part of the innovation. Yeah, that's true.

Yeah, very, I shouldn't say it's a huge surprise, right? You would think that they'd have more confidence that the wings of the demo aircraft would be able to just support themselves, right, considering they're meant to support the entire plane in the air. But coming from the push the truck down the hill guy, can't say I'm that surprised. The main complaint with the iPhone duo, people are getting their hands on the iPhone duo. There's some reviews coming out.

And there seems to be a lot of complaints. The big one being app optimization, let's pull up this image. If we can scroll down, you can see. how apps that you might use frequently like Instagram or Google Calendar or Spotify. This looks like a Rivian app. Also, internet speed check. Anyways, not dialed yet.

I do think that I don't think this is necessarily going to be a huge issue. I think this kind of thing will get fixed pretty quickly. Are you talking about the big sidebar? that's kind of taking up a lot of that. So it's like, hey, we made a phone whose entire value prop is that it's a bigger screen and then as of right now, and again, I expect this to get fixed.

I don't really using the extra real estate. Yeah. The core value prop is not being delivered on yet. Mark German says the iPhone doer reviews are some of the most brutal I've seen from an Apple product in a long time, Vision Pro aside, but I've been around long enough

to remember the iPhone 5, 6, 5, 6, and iPhone X. The app optimization issue is a non-issue and will be resolved in weeks. The one big difference I'd add, the iPhone 5 and iPhone 6 plus gave developers one week of turnaround time, though they've had a month plus and hands-on development opportunities with the duo. So I don't know what Google and Instagram and Spotify are doing if they've had the ability to...

Yeah, they've had a month? They've had roughly a month. but maybe they're just bear on bearish on the duo well i think for like instagram or whatever they probably assume that people are going to be doing kind of they're going to have the like wider so you can do kind of dual-wheeled reels yeah you want to do so they're probably optimising yeah i want to see what it what it looks like um on instagram when you have um the two screens yeah and so i think these are starting to be delivered uh on friday i believe the 23rd so we'll start to get some yeah but somehow people have them out in the wild now. So, MKBHB review, yeah. I assume that he'd get it early.

Let's pull up this video from MKBHD. It is bad. Photo quality. See that selfie camera. Yeah, that is very first-gen. And it is bad. The photo quality is trash. It looks a little better on like a FaceTime call with video than just straight up taking pictures with it. But yeah, Apple clearly has done the math. Like they've assumed people won't use this. camera very much and they've accepted the trade-off of image quality versus having this big dramatic uninterrupted inner display. We'll see that selfie camera. Yeah, I think that's a reasonable trade-off. And the camera's effectively invisible? Yeah. Which is extremely impressive. Yeah. So I'm, this makes me more bullish on this. Yeah, it seems like a pretty good experience. Yeah. I did not get one, but do you want to? I could imagine other people enjoying it. You're not going to get one.

I could. Would you get one if we needed somebody on the team? I could, yeah. To make a sacrifice and do it? A sacrifice? I would sacrifice. I would sacrifice. I mean, because you're going to have a massive oral loss.

That's true, yeah. So you need to prepare for that. You can't be seen pulling this thing out. Cracking it open. I mean, John really does need to do it. He's the newspaper guy. Yeah, yeah. I think he's got to do it.

So I don't think you should have to. It's time to talk about SpaceX. Tesla, SpaceX had their Q3 earnings call yesterday. It is one of the cooler earnings call experiences, even like the countdown, like the imagery that they have, just show why the company ultimately trades in a somewhat detached way from business fundamentals. But they talk about the progress that they've made over the last quarter with Starship. Starship specifically, the stat that stood out is that one starship that was not even full is launching the equivalent of 10 Falcon 9s worth of Starlink satellites. So it just shows how big the payload capacity can be.

And again, they're just going as down the line as fast as possible to get to not just reusability, but rapid reusability. So that's what they're telling people to watch out for over the next quarter. A lot of the call was focused on the terrestrial compute buildout. Elon compared SpaceX and the team there to the other sort of like cloud or Neo-Cloud players as this is like the New York Yankees playing in the Little League.

So not mincing words. And, yeah, the big numbers that stood out, they're talking about two and a half to three gigawatts online by the end of this year with and pacing to get 10 online next year. That being said, he did leave possibility for getting to 20 gigawatts next year. The logic there being like they are building out more, like they're trying to get enough effectively infrastructure in place to support 20 gigawatts even if they don't actually have the power yet.

Yeah. And then, I mean, he kept hinting or vaguely circling around some kind of merger, right? Yeah. I mean, Tesla, SpaceX, that's like a lot of the news about right now. Yeah, before we get into that, we can talk about, let's pull up this clip of him talking about AI. demand. Our belief is that the value of compute per watt will increase over time, not decrease. The reason for that, I think it should be obvious to people really is that as you improve the AI software, as the models get better and better, they're able to, you get more useful intelligence

per what, and the value of that compute is proportionate to the useful intelligence per why. And that's why you see things like even old computers like H-100s renting for more than they rented when they were new. And I think that's likely to continue. I think we're going to face a shortage of superintelligence compute. And that shortage is going to remain for a long time. So I think the smart move is to do short-term contracts and to and essentially to place the bed on useful intelligence per what increasing rapidly,

which obviously is done, so that's what's happened so far. That's why I posted that sort of video meme of the Monty Python cheese shop sketch where the guy goes into a cheese shop to get some cheese and they actually have no cheese. So he goes, like, what about this kind of cheese? What about that kind of cheese? And they really just don't have any cheese. So we've actually tried to offload some of our inputs to... They've got no cheese.

We've got no cheese. And we get the cheese shops again. Yeah, I mean, so presumably those short-term contracts talking about are the anthropic ones, right? It's interesting that he keeps saying, like, short-term contracts. because I think Yeah, people were people That's how people have been making the bear case Around their compute business is like, okay

Like this is a you know temporary solution For companies like Anthropic and Google That are compute constrained But these contracts will roll off And the demand will shift somewhere else And what he's saying is like no, this is intentional We're doing this because we want to basically Every year raise prices, raise prices

because the expected value of the compute will go up. Or at some point, like, use that compute internally for GROC models, right? This is kind of also like the meta maybe case where, like, oh, they'd have this big buildout, and like maybe they're making good use of it now, but at one point people were like, oh, you should just resell it, become a neoc cloud. Yeah, so he definitely talks about Grockbot in the earnings call as well and says he expects most of their compute to go towards Grockbot eventually. and talks about the growth there.

The big line that stood out, which was funny, this was came at the very end of Elon's segment before he passed the mic to Shotwell. Let's listen to it. In a nutshell, what this implies for SpaceX's annual recurring revenue by the end of 27 is somewhere between 500 billion and a trillion. Let's go. I mean,

he literally nods and then oh, it's amazing. Big, big, big numbers. I guess in this case, it's funny, normally people would say annualized revenue run rate, but he said annual recurring revenue. But in this case, it actually could be.

Maybe it's not, yeah, it is annual recurring revenue if they start continuing to stack these, these like annualized deals. People are saying that Musk just saved the neocloud trade with that line. Our belief is that the value of compute per watt will increase over time, not decrease. Yeah, I mean, this is what like semi-analysis has been saying for a long time, right? These things just kind of keep going up. Yeah.

Brett over at ARC is talking about the merger. This seems inevitable at this point. Elon's pretty clear that it's going to be up to the shareholders on either side to decide. He believes it's the right move. And again, people, one of the biggest challenges of having SpaceX and Tesla, both as public companies, is like you can't drive all of that investor demand to one place. And so you're trying to balance, like, supply and demand for both assets. And again, these are like, this is a portfolio of existing. products as well as like but but the companies both companies are valued on their future potential

right yeah so combining them does make a lot of sense i can imagine this as as it's not hard to imagine it as a sort of first 10 trillion dollar company uh brett has a point of view on uh on the merger he says on space x versus tesla very crudely robotaxi is a bigger opportunity than starlink but orbital compute is a much bigger opportunity than robotaxi an opti Optimus requires more baking time than orbital compute. And Optimus's success is predicated on access to gobsmacking amounts. Not a lot of people using that word these days. Maybe it's time to bring it back.

Yeah, yeah. Amounts of super intelligence. The forced usage of super intelligence by our industry has been pretty brutal to watch. It's really, I cringe a little bit every time. Elon responds. Interesting. It just says, interesting. This is obviously his way of drawing attention to things without giving them an endorsement in any way.

So lawyers hate – So many things here make sense, right? Lawyers hate this one simple trick. They don't want you to know this. Yeah, the big thing is that Elon owns so much more of SpaceX that he wants SpaceX to have the highest possible evaluation. and Tesla to have the lowest possible valuation at the time of the merger. What else? Hero Onada says, I know Elon stocks get totally different treatment,

but this is Oracle September 2025, huge claims of future revenue, revenue extremely low-quality business about to become recklessly levered. So he's given the bare case here. Not Elon's first time making huge, claims of future revenue. I think the interesting thing is like even if he's off by five years on on these sort of revenue targets like shareholders are still going to do pretty well. But yeah, very, very clear that they will be levering up in a way that no Elon company has before outside of XAI.

Matthew Zeitland says the American capital markets are the eighth wander of the world and he's quoting the economist and it says in the past year american markets have digested the largest ever initial public offering space x equity raised by a public company google or a foreign firm s k hynex private funding round opening eye and private debt deal broadcom as well as most of the biggest bond issue in history amazon there was the first one trillion dollar exchange traded fund or et fangard vanguard a record-breaking cash pile berkshire hathaway and stock buyback program, NVIDIA, and consummation of the largest ever leveraged buyout, EA. The other crazy thing about a lot of these deals is like they weren't even the current

thing at the time. Like it was the kind of thing where it would be maybe get a mention on the front page of the journal or just be buried in the business section. Big news today, somewhat unexpected. Open AI models are coming to Google Cloud to. frenemies now I guess in many ways open AI and Google strike major AI distribution deal open AI will bring its frontier AI models including GP-6 Astrood codex to Google cloud in the coming weeks enterprise customers will be

able to purchase them through Google Cloud marketplace using existing cloud spending commitments the agreement follows opening eyes expansion to AWS after its exclusive Microsoft distribution arrangement ended in other news opening a acquired orchestra bio a platform that helps biopharmar teams coordinate the complex process of drug development uh-huhendra goes to open-a-i absolutely massive news and super excited for the team over there um ken griffin had some comments yesterday he said we're We're almost certainly in an AI bubble, but that sounds way more bearish than what he was actually saying. In his comments, he's talking a lot about disruption due to AI, but also said it would be a golden age of entrepreneurship.

Let's go. So not all bad. I don't know if this is a serious comment or not, but let's see. Brian Johnson says, I have an AI agent that logs every negative comments. someone makes about me online. It then creates a profile of the person maps all of their social connections and finds all their emails. Tomorrow morning, my AI agent will send out an email blast to everyone's extended social network detailing the horrible things they've said about me. And he says, just kidding, it's not just to their social network, but to the extended network

of everyone they know as well. I'm for real, just kidding on all of this. I thought he would do it. I thought that was actually kind of an interesting experiment, just sort of narcos. on everyone, narking on, on, it's probably millions, don't you think it would be millions of people? Yeah, I mean, if you include, you know, every Instagram comment, there's, I think there's a long tail of these things. Yeah. Yeah. Yeah. Bucco Capital says some years ago, I just stopped logging into Netflix and never really thought about it again.

Honestly, surprised, it's still worth $275 billion. And I read this and I agree. I think I still pay for Netflix. I never use it. I would, it's interesting to think about how much you would pay for YouTube versus Netflix. Like my willingness to pay for YouTube would probably be in the thousands of dollars a year. And I would probably take $1,000 in exchange for never being at a week. to use Netflix ever again.

Yeah, I agree. I mean, so much of the content stuff is hard because now, like, 10 years ago, whatever, you don't have all the competing streaming platforms with, like, oh, actually my favorite show is on this, so maybe for this month we'll get this, and our family, you know, we can move over for a little bit to try this one. I have not used Netflix in a long time. Oh, WAP raised $200 million in Series D funding from Sequoia and Shopify. very cool to see Shopify coming in as a strategic.

And yeah, I think that in many ways, WAP is the Shopify for a whole new category of work on the internet. And I think Stephen and the team have been pretty consistently underestimated by a lot of the market, but are extremely serious operators. And have shown, like, massive ability to, like, be flat. flexible and evolve with their customers, which, yeah, the work that they're doing in various forms, whether it's clipping or courses, is constantly evolving. Yeah. But that's it. We did it. We made it through. But that's it. We did it.

We made it through. We made it through. I've always said that if I wouldn't be podcasting, if it wasn't for John, but. Nor would I. Nor would you, nor would any of us. But I'm glad we can do it. It's good that we can. We're not going to do it again.

That's John's last six day for the year. So as we head into flu season, just remember John. You already use your day up. It's over. Any final words? Do you remember what John says? Follow us on Apple Podcasts, Spotify, YouTube.

Subscribe to our newsletter. What else is there? I think that's it, right? Can't forget. Oh, how many days? Oh, yeah. What are we at? 64 days.

We're right there. We're in the final stretch now. We're in the final innings. That's it, folks. Leave us five stars. Wow, really delayed flash. We love you guys. See you tomorrow.