Musk Targets $1T SpaceX Revenue as AI Model Audits Expose PHP Flaw

Cybersecurity Red Alert, SpaceX Earnings, OpenAI Strikes Google Deal | Diet TBPN — TBPN

TBPN

SpaceX's explosive compute push positions it to monetize rising intelligence value per watt while systemic software vulnerabilities across legacy PHP servers trigger emergency global patching.

AI-assisted summary of Cybersecurity Red Alert, SpaceX Earnings, OpenAI Strikes Google Deal | Diet TBPN — original source. Check the original for full context.

Source published:

Key ideas

  • A critical memory flaw dubbed 'PHP 2 Shell', discovered via AI code audits, affects software powering roughly 70% of the web, prompting secret coordination and precautionary service shutdowns across several European nations. (2:27)
  • SpaceX reported massive compute and space milestones during its Q3 update, projecting between $500 billion and $1 trillion in annual recurring revenue by late 2027 while planning up to 20 gigawatts of data center infrastructure. (16:42)
  • Early reviews of Apple's iPhone Duo flag severe third-party app scaling issues and low-quality under-display selfie cameras, balanced against an uninterrupted inner canvas. (13:05)
  • OpenAI expanded its multi-cloud footprint by bringing GPT-6, Astra, and Codex to Google Cloud Marketplace, and acquired life sciences orchestration platform Orchestra Bio. (27:30)

Detailed notes

## Background This video was published on YouTube by the tech news channel TBPN on October 21, 2026. Part of the "Diet TBPN" daily series hosted by John Coogan and Jordi Hays, the episode delivers a 30-minute recap of breaking technology stories spanning cybersecurity, AI platform deals, and space exploration.

## TL;DR With regular co-host John out sick, guest host Tyler joins Jordi to break down a critical AI-discovered PHP memory flaw dubbed "PHP 2 Shell" that sparked an emergency worldwide patching effort. The hosts examine rough launch reviews for Apple's iPhone Duo and poke fun at Trevor Milton's new jet venture featuring showroom wings propped up on posts. They also analyze SpaceX's massive Q3 earnings call—focusing on Starship's scaling lift capacity, Elon Musk's staggering $500B–$1T ARR projection, and rumors of a Tesla merger—before wrapping up with OpenAI's expansion onto Google Cloud Marketplace and Whop's $200 million Series D funding round.

## Atmosphere & style The broadcast carries an energetic, playful morning-show vibe that balances high-stakes industry analysis with deadpan humor. Tyler wearing John's oversized suit sets an immediate comedic, self-deprecating baseline that carries into running jokes about awkward tech demonstrations and social faux pas. As the conversation moves from critical cybersecurity threats to multi-trillion-dollar corporate projections, the dynamic remains brisk, colloquial, and sharply observant.

## Bulletin - [02:27](https://www.youtube.com/watch?v=aojgN8IyR54&t=147s) A critical memory flaw dubbed 'PHP 2 Shell', discovered via AI code audits, affects software powering roughly 70% of the web, prompting secret coordination and precautionary service shutdowns across several European nations. - [16:42](https://www.youtube.com/watch?v=aojgN8IyR54&t=1002s) SpaceX reported massive compute and space milestones during its Q3 update, projecting between $500 billion and $1 trillion in annual recurring revenue by late 2027 while planning up to 20 gigawatts of data center infrastructure. - [13:05](https://www.youtube.com/watch?v=aojgN8IyR54&t=785s) Early reviews of Apple's iPhone Duo flag severe third-party app scaling issues and low-quality under-display selfie cameras, balanced against an uninterrupted inner canvas. - [27:30](https://www.youtube.com/watch?v=aojgN8IyR54&t=1650s) OpenAI expanded its multi-cloud footprint by bringing GPT-6, Astra, and Codex to Google Cloud Marketplace, and acquired life sciences orchestration platform Orchestra Bio.

## Key takeaways - [02:27](https://www.youtube.com/watch?v=aojgN8IyR54&t=147s) A severe vulnerability named 'PHP 2 Shell' was identified using frontier AI models, exposing decade-old memory flaws in server software running roughly 70% of websites. - [05:00](https://www.youtube.com/watch?v=aojgN8IyR54&t=300s) Defenders faced a narrow window to patch 10,000+ lines of code across 200 files before public disclosure and automated exploit generation by malicious actors. - [05:00](https://www.youtube.com/watch?v=aojgN8IyR54&t=300s) Greg Brockman suggested future internet defense may require authorized entities, including governments, to scan and remotely patch critical vulnerabilities across the web. - [10:00](https://www.youtube.com/watch?v=aojgN8IyR54&t=600s) A security audit at eMudhra revealed an absurdly trivial TLS private key consisting of the single digit 'four' that remained unexploited online for 18 months. - [11:15](https://www.youtube.com/watch?v=aojgN8IyR54&t=675s) Pardoned Nikola founder Trevor Milton drew ridicule after unveiling a private jet whose static demonstration model featured wings visibly propped up with posts. - [13:05](https://www.youtube.com/watch?v=aojgN8IyR54&t=785s) Initial reviews of Apple's iPhone Duo were weighed down by poor aspect-ratio optimization across key apps like Spotify and Google Calendar despite developers having over a month of advance access. - [13:05](https://www.youtube.com/watch?v=aojgN8IyR54&t=785s) Apple accepted poor under-display selfie camera fidelity to provide an uninterrupted interior screen free of notches or cutouts. - [16:42](https://www.youtube.com/watch?v=aojgN8IyR54&t=1002s) SpaceX revealed that a single non-full Starship mission matched the payload capacity of ten Falcon 9 Starlink launches as the firm pushes for rapid reusability. - [16:42](https://www.youtube.com/watch?v=aojgN8IyR54&t=1002s) Elon Musk challenged cloud incumbents by outlining plans for 2.5 to 3 GW of SpaceX compute capacity by year-end, scaling toward a 10 to 20 GW pipeline. - [20:00](https://www.youtube.com/watch?v=aojgN8IyR54&t=1200s) Musk argued that compute per watt appreciates over time as models improve, allowing SpaceX to leverage short-term compute contracts with rolling price hikes before migrating capacity to Grok. - [23:34](https://www.youtube.com/watch?v=aojgN8IyR54&t=1414s) Analysts and investors evaluated a potential SpaceX and Tesla merger that could theoretically create the first $10 trillion company, balancing orbital compute against robotics. - [27:30](https://www.youtube.com/watch?v=aojgN8IyR54&t=1650s) OpenAI deepened its distribution by offering frontier models on Google Cloud Marketplace to let enterprise clients draw down cloud commitments. - [27:30](https://www.youtube.com/watch?v=aojgN8IyR54&t=1650s) Ken Griffin characterized the current artificial intelligence cycle as a bubble that will nevertheless trigger a golden age of entrepreneurship. - [29:52](https://www.youtube.com/watch?v=aojgN8IyR54&t=1792s) Whop raised a $200 million Series D backed by Sequoia and Shopify, solidifying its position as digital commerce infrastructure for creator communities and internet products.

## Detailed walkthrough ### [00:00](https://www.youtube.com/watch?v=aojgN8IyR54&t=0s) John’s Out Sick + The Show Must Go On

The show opens with an immediate update for viewers: co-host John Coogan is absent due to illness. The hosts share that they almost never take sick days, noting, “Normally when we're sick, we just keep going. But John is really down and out.” Feeling “like a ship without a sail” and “a lighthouse without a light,” guest host Tyler steps into the studio wearing John’s entire suit. The hosts joke about how the oversized outfit looks like something out of a Nathan Fielder bit, though it surprisingly manages to look reasonably normal. They reassure everyone that it isn't an injury from working out, just peak flu season.

Despite running behind the console with technical hiccups as they fiddle with sound effects and ad drops, they emphasize that keeping the broadcast running is an art form. The hosts run through a busy upcoming lineup, previewing an appearance by Nikesh Arora, CEO of Palo Alto Networks, to unpack the breaking security news, as well as an interview with Aidan Gomez of Cohere following their massive new $800 million funding round. Before transitioning to the day's tech headlines, they deliver an ad read for Ramp, highlighting its corporate cards, bill payments, and accounting tools, and briefly laugh over a recent video clip of John before he fell ill.

[02:27](https://www.youtube.com/watch?v=aojgN8IyR54&t=147s) AI Finds a Major PHP Flaw + The Race to Patch the Internet

The discussion pivots to a massive vulnerability shaking the web: PHP, the server-side language powering roughly 70% of all websites, has suffered a critical security flaw dubbed "PHP 2 Shell." The flaw was originally uncovered in August during source code audits assisted by frontier AI models. For the past two months, security researchers, public companies, and foundation engineers worked in secret to prepare patches before public disclosure. While enterprise networks and major platforms were briefed in advance, the hosts express severe concern for the unmanaged long tail of the web.

```mermaid flowchart TD accTitle: Discovery and Race to Patch PHP 2 Shell accDescr: Process flow showing AI vulnerability discovery leading to coordinated defense and patching efforts. subgraph Discovery ["1. AI-Driven Discovery"] A["Auditing PHP Source Code<br/>(OpenAI-funded initiative)"] --> B["Identified 'PHP 2 Shell'<br/>Critical memory management flaw"] end subgraph Exploitation ["2. Exploit Risk Profile"] B --> C["Few dozen requests control memory"] C --> D["Fast compromise:<br/>Seconds (simple) to hours (complex)"] end subgraph Defense ["3. Secret Global Response"] D --> E["Working Group Formed<br/>(Calif, Wiz, OpenAI, PHP Project)"] E --> F["Patch Engineering:<br/>~200 files, 10,000+ lines of code"] F --> G["Release Race:<br/>Defenders patch vs. AI-armed attackers"] end ```

The hosts worry deeply about legacy servers, local municipal infrastructure, and regional businesses running unattended machines that hold sensitive user data such as Social Security numbers. As word of the exploit spread, several European countries, including Finland, the Netherlands, and France, took select government and public internet services offline temporarily as a precautionary shield until updates could be safely deployed. Security engineer Volker from the nonprofit foundation that manages PHP likened the scale of the threat to Heartbleed, the infamous OpenSSL vulnerability that triggered a global remediation race over a decade ago.

- PHP runs on approximately 70% of all websites across the global internet. - "PHP 2 Shell" stems from memory management flaws that allow attackers to execute unauthorized code on unpatched web servers. - The exploit can execute in seconds on basic servers, and takes up to several hours on complex infrastructure with as few as several dozen targeted requests.

[05:00](https://www.youtube.com/watch?v=aojgN8IyR54&t=300s) The Mechanics of the Breach and the Coordinated Defense

Explaining how the bug surfaced, the hosts detail how security firm Calif discovered the flaw with assistance from advanced AI systems during an OpenAI-funded open source security audit. The underlying memory management defect had lurked inside PHP's codebase for decades, previously flagged by researchers but dismissed as practically impossible to weaponize until AI demonstrated an attack path. When the severity became clear, an informal working group formed across Calif, Wiz cybersecurity researchers, OpenAI, and PHP's leadership to coordinate a fix before black-hat hackers could automate the attack. Ami Lutwak, Wiz's co-founder, highlighted that “PHP 2 Shell is the most severe AI vulnerability that was ever found, and one that was likely too complex to have been discovered without AI.”

The race between software defenders and automated exploit generators underscores a dangerous new reality for internet infrastructure. Addressing this shift, Ty, the chief executive of Calif, warned: “Some dude on Twitter could take the patches and run AI against it and post some exploit script... All hell will break loose.” The repair required an enormous engineering overhaul spanning nearly 200 files and over 10,000 lines of code.

Although the coordinated patch release was initially scheduled for October 22nd, details leaked early via Hacker News, forcing rapid emergency disclosures. OpenAI's Greg Brockman argued online that defense must evolve, writing, “As vulnerability discovery ramps we will need new defense solutions potentially including authorized defenders such as government, scanning the Internet for vulnerable hosts and either notifying or, in extreme cases, patching those systems remotely.”

International leaders also sounded the alarm. The Prime Minister of Japan posted an urgent public plea warning website operators of two critical vulnerabilities and recommending that operators temporarily take down their services if they could not immediately install the patch. Demonstrating the casual disconnect still present across industry IT, the hosts share a story posted by indie developer Pieter Levels (Levels.io): when Levels messaged a friend at a major tech company whose entire infrastructure relies on PHP, the employee nonchalantly replied, “thanks, I'll try to patch it in a few days as I'm out of office now.”

[10:00](https://www.youtube.com/watch?v=aojgN8IyR54&t=600s) Web Vulnerabilities: PHP Exploits and Trivial TLS Keys

The discussion continues on the fallout of critical internet security vulnerabilities, focusing on traditional companies running legacy PHP installations. Because enterprise update cycles are notoriously slow, unpatched systems will remain sitting ducks once public patches reveal how to reverse engineer the exploit. The hosts anticipate widespread website breaches and user data exposure as automated scans target lagging infrastructure. Meanwhile, an equally alarming issue emerged from eMudhra regarding TLS certificates—the cryptographic backbone behind the browser security padlock. Certain private keys were shockingly weak, with one reported to be a single digit rather than the standard hundreds of digits required for modern public-key cryptography.

The hosts find dark humor in the absurdity of the blunder, joking that a private key of "four" is so blatantly insecure that nobody would ever guess it, turning an outright failure into an inadvertent "white pill" since it apparently sat undetected online for a year and a half without catastrophic consequences. To counter emerging software bugs, AI companies are stepping in with autonomous remediation tooling. OpenAI shipped a Codex skill linked to a dedicated GitHub repository designed to automatically walk developers through auditing and securing their codebases against the flaw.

- Traditional enterprise patch delays mean malicious actors can easily reverse engineer security updates to exploit exposed sites. - An eMudhra vulnerability surfaced involving absurdly trivial TLS private keys—including an instance where a private key was literally the single number four. - The single-digit key had been live online for roughly 18 months before remediation, seemingly without widespread malicious exploitation. - “OpenAI released a Codex skill to help check whether your website is affected,” providing an automated workflow through a public GitHub repository.

[11:15](https://www.youtube.com/watch?v=aojgN8IyR54&t=675s) Trevor Milton’s Aviation Venture and Propped-Up Wings

Attention turns to Trevor Milton, the controversial founder of Nikola who was recently pardoned, and his return to business with a private jet company. While technically building on top of a corporate entity that has existed for decades, Milton’s re-emergence into high-end aviation draws extreme skepticism. Private aviation caters to ultra-wealthy, discerning clients who demand absolute safety and reliability, making Milton’s fraught public reputation a brutal liability. The hosts joke about whether an investor could exploit a "stigma discount" on the aircraft, buying in while others are fearful, before conceding that Warren Buffett's maxim applies to capital allocation—not placing your life inside a dubious physical machine.

```mermaid flowchart TD accTitle: Trevor Milton Aviation Skepticism accDescr: Diagram showing the skepticism around Trevor Milton's new aircraft reveal given his past history. subgraph Past["Historical Reputation"] A["Nikola Truck Scandal<br>('Push the truck down the hill')"] B["Presidential Pardon<br>(Free to operate legally)"] end subgraph Present["New Jet Venture"] C["Target: Discerning Private Jet Buyers"] D["Demo Aircraft Reveal"] E["Wings Held Up by Support Posts"] end A --> B B --> C C --> D D --> E ```

The skepticism hits peak hilarity when discussing photos from the launch event attended by friend-of-the-show Preston Holland. Attendees noticed that the wings of the static demonstration aircraft were visibly propped up from underneath by vertical support posts. For an aircraft whose wings are meant to withstand structural aerodynamic loads in mid-air, relying on manual props on a showroom floor looks absurd. As the hosts put it:

> “Considering they're meant to support the entire plane in the air, but coming from the 'push the truck down the hill' guy, I can't say I'm that surprised.”

[13:05](https://www.youtube.com/watch?v=aojgN8IyR54&t=785s) iPhone Duo Reviews: App Optimization and the Compromised Selfie Cam

The conversation shifts to initial consumer and reviewer impressions of the iPhone Duo as review units land in the wild ahead of its official Friday launch. Early feedback has been harsh, dominated by severe app optimization issues. Popular applications like Instagram, Google Calendar, Spotify, and Rivian are displaying poorly calibrated interfaces, frequently wasting space with giant awkward sidebars rather than taking advantage of the expanded screen estate. While Bloomberg’s Mark Gurman observed that these are some of the most brutal initial reviews for an Apple flagship since the Vision Pro, he reminded readers that early transitions like the iPhone 5, 6 Plus, and iPhone X suffered through similar growing pains that were remedied within weeks. The hosts note a crucial difference: third-party developers had over a month of hands-on device access this time around, leaving some wondering whether companies like Meta and Google are simply slow or secretly bearish on the form factor.

Turning to Marques Brownlee’s (MKBHD) hardware impressions, the hosts inspect the radical design trade-offs Apple chose for the interior display. To deliver a seamless, unbroken inner screen without a notch or punch-hole cutout, Apple tucked the front-facing camera completely underneath the display panel. The resulting selfie photo quality is downright "trash"—reminiscent of very early first-generation hardware—though it holds up slightly better during live FaceTime video feeds. Despite the terrible photo fidelity, the host defends the decision as a logical engineering compromise, appreciating that the camera remains completely invisible to the eye:

> “Apple clearly has done the math. Like they've assumed people won't use this camera very much and they've accepted the trade-off of image quality versus having this big, dramatic, uninterrupted inner display.”

- Early iPhone Duo reviews highlight massive wasted screen space and poor scaling across major apps like Spotify and Google Calendar. - Apple previously gave developers as little as a single week to adapt to new aspect ratios; for the Duo, top developers had over a month of hands-on access. - Under-display front camera optics deliver terrible still-photo clarity, but succeed in maintaining an uninterrupted visual canvas. - The hosts joke about the social penalties of adopting the foldable device in public, teasing that cracking the device open causes a "massive aura loss" and insisting co-host John Coogan should be the one to carry it.

[16:42](https://www.youtube.com/watch?v=aojgN8IyR54&t=1002s) SpaceX Q3 Earnings: Starship Scale and Compute Power Play

The show moves to SpaceX’s Q3 earnings call, which resembled a cinematic space event complete with high-production countdowns that show why the company's valuation often detaches from conventional business fundamentals. The biggest operational revelation centered on the sheer lift capacity of Starship: in a single mission where the vehicle wasn't even entirely filled to capacity, it deployed a payload equivalent to ten separate Falcon 9 launches of Starlink satellites. The company emphasized that its top strategic priority remains pushing as aggressively as possible toward rapid reusability.

Beyond space operations, SpaceX shocked observers with the sheer magnitude of its terrestrial compute ambitions. Elon Musk directly targeted legacy and emerging neo-cloud providers, boasting that SpaceX's data center engineering operation is like “the New York Yankees playing in the Little League.” SpaceX is planning to bring 2.5 to 3 gigawatts of power capacity online by the end of the year, with a pipeline targeting 10 gigawatts next year, and potential infrastructure prep scaling all the way to 20 gigawatts. Musk also dropped teasing remarks about an eventual corporate tie-up or merger between SpaceX and Tesla, while expounding on why hardware like older Nvidia H100s continues to appreciate rather than depreciate in rental markets:

> “Our belief is that the value of compute per watt will increase over time, not decrease... As you improve the AI software, as the models get better and better, you get more useful intelligence per watt, and the value of that compute is proportionate to the useful intelligence per watt.”

[20:00](https://www.youtube.com/watch?v=aojgN8IyR54&t=1200s) Superintelligence Compute Shortages and Elon Musk's Massive ARR Projections

The hosts examine Elon Musk’s strategy regarding compute infrastructure and why he favors short-term agreements over long-term commitments. Drawing an analogy to the famous Monty Python "Cheese Shop" sketch—where a customer attempts to buy various cheeses only to discover the shop possesses none—Musk illustrates that when customers attempt to offload AI training, they discover compute capacity simply is not there. The hosts note that this shortage explains why short-term contracts, such as those with Anthropic, make tactical sense. While bears initially argued that these arrangements were merely stopgaps for compute-starved firms like Anthropic and Google that would soon roll off, Musk views the dynamic intentionally: raising prices year after year as the expected value of compute escalates, while reserving future capacity for internal Grok models and GrokBot.

```mermaid flowchart LR accTitle: Compute Capacity Allocation Strategy accDescr: Diagram illustrating how short-term contracts allow rolling pricing hikes until internal Grok demand consumes capacity. A["Compute Shortage"] --> B["Short-Term Contracts<br>(Anthropic, Google)"] B --> C["Annual Price Hikes<br>(Rising Value/Watt)"] C --> D["Internal Migration<br>(Grok Models & GrokBot)"] ```

The hosts review Musk’s striking projection right before handing the presentation over to Gwynne Shotwell: “In a nutshell, what this implies for SpaceX annual recurring revenue by the end of '27 is somewhere between 500 billion and a trillion.” While corporate leaders typically cite annualized run rates rather than pure recurring revenue, the hosts suggest it could truly become recurring as deals continue stacking. Commentators remarked that Musk effectively resurrected the NeoCloud trade with the assertion: “Our belief is that the value of compute per watt will increase over time, not decrease.”

- SemiAnalysis has long maintained the position that compute pricing per watt would trend higher. - Elon expects the bulk of long-term compute capacity to be absorbed directly by GrokBot.

[23:34](https://www.youtube.com/watch?v=aojgN8IyR54&t=1414s) The SpaceX–Tesla Merger Debate and Bull Cases

The conversation turns to mounting speculation regarding a merger between SpaceX and Tesla, an outcome ARK Invest’s Brett Winton and others view as increasingly probable. Operating both as separate public equities forces management to balance investor appetite across two entities rather than concentrating market enthusiasm into a single flagship asset. Given that both businesses derive immense value from forward-looking potential, combining them could realistically produce the world's first $10 trillion company.

The hosts highlight Brett Winton’s framework contrasting the components of each business: - **Starlink vs. Robotaxi:** Robotaxi presents a larger addressable opportunity than Starlink. - **Robotaxi vs. Orbital Compute:** Orbital compute dwarfs Robotaxi. - **Execution Timelines:** Optimus demands significantly more developmental "baking time" than orbital compute. - **Core Dependency:** “Optimus's success is predicated on access to gobsmacking amounts of superintelligence.”

The hosts chuckle at the resurgence of the word "gobsmacking" while cringing at how the tech sector has forced the term "superintelligence" into everyday parlance. Musk’s terse reply—"interesting"—is identified as his classic method of spotlighting an idea without making a legally binding endorsement. Financial incentives also play a role: because Musk holds a substantially larger equity stake in SpaceX than in Tesla, he would logically benefit from SpaceX securing the highest possible relative valuation at the moment of any merger.

Pushback from skeptics is acknowledged: bear commentator Hero Onoda compared the forward-looking hype to Oracle in September 2025, warning of low-quality future revenues and an enterprise about to become recklessly leveraged. Nonetheless, the hosts point out that even if Musk misses his aggressive projections by five years, historical returns suggest long-term investors still tend to perform exceptionally well.

[27:30](https://www.youtube.com/watch?v=aojgN8IyR54&t=1650s) American Capital Markets and OpenAI’s Expanding Alliances

The discussion highlights the extraordinary capacity of American capital markets, citing Matthew Zeitlin quoting *The Economist* on how public and private markets absorbed historic transaction volume over a single year. These included: - SpaceX’s record initial public offering - Google’s equity raise - SK Hynix’s overseas capital raise - OpenAI’s private venture financing round - Broadcom’s private debt package - Amazon’s record bond issuance - Vanguard’s launch of the first $1 trillion ETF - Berkshire Hathaway’s historic cash reserves - NVIDIA’s massive share repurchase program - The completion of EA’s record leveraged buyout

Against this macro backdrop, OpenAI announced that its frontier models—including GPT-6, Astra, and Codex—are arriving on Google Cloud Marketplace, permitting enterprise clients to draw down existing cloud commitments. Following OpenAI’s earlier expansion to AWS after the conclusion of its exclusive Microsoft distribution deal, Google and OpenAI have officially settled into a "frenemies" relationship. OpenAI also acquired Orchestra Bio, an orchestration platform designed to streamline complex biopharmaceutical drug development pipelines.

Market sentiment on artificial intelligence remains nuanced. Citadel’s Ken Griffin observed that while we are almost certainly navigating an AI bubble, he framed the cycle positively, arguing that it signals a pending “golden age of entrepreneurship.” On the lighter side of tech culture, tech entrepreneur Bryan Johnson posted a spoof claiming he built an AI agent to profile online detractors, trace their social connections, and blast their emails to everyone they know—only to clarify he was merely joking about weaponizing automated retaliation.

[29:52](https://www.youtube.com/watch?v=aojgN8IyR54&t=1792s) YouTube vs. Netflix and Wop's $200M Series D

The episode closes by evaluating consumer entertainment value. Reacting to a Pucco Capital post expressing surprise that Netflix maintains a $275 billion valuation despite forgotten logins, the host confesses to paying for Netflix while virtually never opening it. By contrast, user utility has tipped decisively toward creator-driven video: “My willingness to pay for YouTube would probably be in the thousands of dollars a year, and I would probably take $1,000 in exchange for never being able to use Netflix ever again.” The fragmentation of streaming libraries and recurring subscription management have eroded the convenience traditional entertainment platforms once offered.

Attention shifts to creator infrastructure, specifically Whop securing $200 million in Series D funding backed by Sequoia Capital and Shopify. Bringing Shopify on board as a strategic investor cements Whop's status as the commercial operating system for modern internet knowledge, communities, and digital services:

> “In many ways Whop is the Shopify for a whole new category of work on the internet.”

The hosts praise founder Steven and the executive team as consistently underestimated operators who demonstrated nimble execution as creator monetization shifted across clipping, community memberships, and educational courses.

Wrapping up the broadcast, the hosts joke that co-host John has officially burned his one permitted sick day for the entire year just as flu season approaches: “That's John's last sick day for the year. So as we head into flu season, just remember, John, you already used your day up.” Reminding listeners of their 64-day milestone, they sign off with their customary calls to review and subscribe across Apple Podcasts, Spotify, and YouTube.

## Notable quotes > [05:00](https://www.youtube.com/watch?v=aojgN8IyR54&t=300s) PHP 2 Shell is the most severe AI vulnerability that was ever found, and one that was likely too complex to have been discovered without AI. — Ami Lutwak

> [05:00](https://www.youtube.com/watch?v=aojgN8IyR54&t=300s) As vulnerability discovery ramps we will need new defense solutions potentially including authorized defenders such as government, scanning the Internet for vulnerable hosts and either notifying or, in extreme cases, patching those systems remotely. — Greg Brockman

> [23:34](https://www.youtube.com/watch?v=aojgN8IyR54&t=1414s) Optimus's success is predicated on access to gobsmacking amounts of superintelligence. — Brett Winton

> [16:42](https://www.youtube.com/watch?v=aojgN8IyR54&t=1002s) As you improve the AI software, as the models get better and better, you get more useful intelligence per watt, and the value of that compute is proportionate to the useful intelligence per watt. — Elon Musk

## Mentioned TBPN, John Coogan, Jordi Hays, Tyler, Nikesh Arora, Palo Alto Networks, Aidan Gomez, Cohere, Ramp, PHP, PHP 2 Shell, OpenAI, Calif, Wiz, Heartbleed, OpenSSL, Ami Lutwak, Ty, Greg Brockman, Hacker News, Pieter Levels, eMudhra, Codex, GitHub, Trevor Milton, Nikola, Preston Holland, Warren Buffett, iPhone Duo, Mark Gurman, Vision Pro, Marques Brownlee (MKBHD), Instagram, Google Calendar, Spotify, Rivian, SpaceX, Tesla, Starship, Starlink, Falcon 9, Elon Musk, Gwynne Shotwell, Anthropic, Google, Grok, GrokBot, Nvidia, SemiAnalysis, ARK Invest, Brett Winton, Robotaxi, Optimus, Hero Onoda, Oracle, Matthew Zeitlin, The Economist, SK Hynix, Broadcom, Amazon, Vanguard, Berkshire Hathaway, Electronic Arts (EA), GPT-6, Astra, Google Cloud Marketplace, AWS, Microsoft, Orchestra Bio, Citadel, Ken Griffin, Bryan Johnson, Pucco Capital, Netflix, YouTube, Whop, Sequoia Capital, Shopify, Steven

## Video description Sign up for TBPN’s daily newsletter at TBPN.com

Diet TBPN delivers the best of today’s TBPN episode in 30 minutes. TBPN is a live tech talk show hosted by John Coogan and Jordi Hays, streaming weekdays 11–2 PT on X and YouTube, with each episode posted to podcast platforms right after.

Described by The New York Times as “Silicon Valley’s newest obsession,” the show has recently featured Mark Zuckerberg, Sam Altman, Mark Cuban, and Satya Nadella.

TBPN is made possible by: Ramp - https://ramp.com Public - https://public.com Cisco - https://www.cisco.com Console - https://www.console.com CrowdStrike - https://www.crowdstrike.com Figma - https://www.figma.com MongoDB - https://www.mongodb.com NYSE - https://www.nyse.com Railway - https://railway.com Shopify - https://www.shopify.com/

Follow TBPN: https://TBPN.com https://x.com/tbpn https://open.spotify.com/show/2L6WMqY3GUPCGBD0dX6p00?si=674252d53acf4231 https://podcasts.apple.com/us/podcast/technology-brothers/id1772360235 https://www.youtube.com/@TBPNLive

Chapters: 00:00 John’s Out Sick + The Show Must Go On 02:27 AI Finds a Major PHP Flaw + The Race to Patch the Internet 11:15 Trevor Milton’s Jet Reveal + Why Are the Wings Propped Up? 13:05 iPhone Duo’s Rough Reviews + Apps & Camera Trade-Offs 16:42 SpaceX Earnings + Elon’s $500B–$1T Revenue Prediction 23:34 SpaceX–Tesla Merger Talk + The $10T Bull Case 27:30 OpenAI’s Google Cloud Deal + AI Bubble Talk 29:52 YouTube vs. Netflix + The Creator Economy

[Source](https://www.youtube.com/watch?v=aojgN8IyR54)

中文简报

马斯克瞄准SpaceX万亿美元营收，AI代码审计暴露PHP漏洞 SpaceX强力推进算力布局，蓄势将持续攀升的每瓦智能价值变现，而传统PHP服务器的系统性软件漏洞则引发全球紧急修补。 由于常驻搭档John生病请假，特邀主持人Tyler与Jordi一同深入剖析了一个由AI发现、名为“PHP 2 Shell”的关键PHP内存漏洞，该漏洞引发了全球范围内的紧急修补行动。两位主持人探讨了苹果iPhone Duo略显坎坷的发售初期评价，并调侃了Trevor Milton用支柱撑起展厅机翼的新私人飞机创业项目。他们还详细分析了SpaceX规模庞大的第三季度业绩电话会，重点关注星舰不断提升的运载能力、埃隆·马斯克令人震惊的5000亿至1万亿美元年度经常性收入预期，以及与特斯拉合并的传言；最后讨论了OpenAI入驻Google Cloud Marketplace以及Whop获得的2亿美元D轮融资。 通过AI代码审计发现的名为“PHP 2 Shell”的关键内存漏洞波及为全球约70%网站提供支持的软件，促使多个欧洲国家展开秘密协调并采取预防性停机措施。 (2:27) SpaceX在第三季度更新中公布了算力与航天领域的重大里程碑，预计到2027年底年度经常性收入将达到5000亿至1万亿美元，同时计划建设高达20吉瓦的数据中心基础设施。 (16:42) 苹果iPhone Duo的早期评测指出了严重的第三方应用缩放适配问题以及低质的屏下前置摄像头，但同时也肯定了其完整无孔的内部主屏画布。 (13:05) OpenAI将GPT-6、Astra和Codex引入Google Cloud Marketplace以扩展多云布局，并收购了生命科学编排平台Orchestra Bio。 (27:30)

Reading summary

The technology landscape is confronting a critical shift as artificial intelligence models simultaneously uncover major internet infrastructure vulnerabilities and drive unprecedented compute expansion. Across enterprise security, aerospace, and cloud distribution, organizations are racing to patch legacy systems while commercial giants realign infrastructure and capital for intensive AI workloads. AI Vulnerability Discovery and Infrastructure Exposure (2:27) Security researchers at Calif, working under an OpenAI-funded open-source audit, discovered a critical memory-management flaw termed "PHP 2 Shell." The defect had remained dormant in PHP's codebase for decades and threatened roughly 70% of the web by permitting unauthorized remote code execution in anywhere from seconds to several hours with only a few dozen requests. A coordinated coalition spanning Calif, Wiz, OpenAI, and PHP foundation engineers drafted an emergency overhaul across nearly 200 files and over 10,000 lines of code. Early leaks on Hacker News accelerated disclosures, leading Japan’s Prime Minister to issue public advisories and prompting Finland, the Netherlands, and France to temporarily take select public web services offline as a precaution. Legacy enterprise patch delays present ongoing exposure, as reverse-engineered fixes allow malicious actors to exploit unpatched systems. Compounding web security concerns, identity firm eMudhra revealed trivial TLS private keys—including one instance where a single-digit private key had operated undetected online for roughly 18 months. To assist remediation, OpenAI deployed an automated Codex skill and public GitHub repository to help developers audit vulnerable codebases. Hardware Compromises and Dubious Aircraft Demonstrations (11:15) High-profile physical hardware projects faced severe early scrutiny, beginning with pardoned Nikola founder Trevor Milton's entry into private aviation. At an unveiling event, attendees observed that the static demonstration aircraft featured wings held up from underneath by vertical support posts, drawing heavy skepticism from observers regarding structural integrity given Milton’s controversial history with unpowered vehicle demonstrations. Simultaneously, early reviews for Apple’s iPhone Duo spotlighted significant software calibration issues and hardware trade-offs. Major third-party applications, including Spotify, Google Calendar, Instagram, and Rivian, exhibited poorly scaled interfaces with wasted screen margins despite developers having hands-on access for over a month. On the hardware side, Apple embedded the interior selfie camera beneath the display panel to preserve an uninterrupted screen. While functional for live FaceTime calls, the design resulted in severely compromised still-photo clarity. SpaceX Terrestrial Compute Strategy and Merger Speculation (16:42) SpaceX outlined massive infrastructure plans during its Q3 earnings call, coupling operational Starship milestones—deploying payloads equivalent to ten Falcon 9 missions in a single flight—with a major push into terrestrial data centers. Boasting that its data center engineering outperforms competing neo-cloud providers, SpaceX aims to bring 2.5 to 3 gigawatts of power online by year-end, scaling to 10 gigawatts the following year with infrastructure plans up to 20 gigawatts. Contending that compute value per watt appreciates as AI models advance, Elon Musk stated SpaceX favors rolling short-term external contracts with firms like Anthropic and Google at increasing prices before eventually reallocating that capacity internally to Grok and GrokBot, projecting $500 billion to $1 trillion in annual recurring revenue by late 2027. These projections revitalized debate over an eventual merger between SpaceX and Tesla. Analysts such as ARK Invest’s Brett Winton argued that combining Tesla’s Optimus robotics and Robotaxi initiatives—which demand vast superintelligence compute—with SpaceX's infrastructure could create a $10 trillion entity. However, market skeptics caution that the aggressive targets resemble past tech cycle overexuberance and carry the risk of heavy leverage. Cloud Marketplace Shifts and Creator Commerce Platforms (27:30) Amid record transaction volumes in American capital markets spanning mega-cap bond issues, debt packages, and public offerings, major AI distribution channels expanded. Following earlier agreements with Microsoft and AWS, OpenAI listed frontier models such as GPT-6, Astra, and Codex on the Google Cloud Marketplace, establishing an enterprise "frenemies" framework allowing clients to draw down existing Google Cloud commitments. Broadening its domain footprint, OpenAI also acquired biopharmaceutical orchestration platform Orchestra Bio. In creator-focused enterprise software, Whop completed a $200 million Series D financing round led by Sequoia Capital with strategic investment from Shopify. The round validates Whop's positioning as specialized commercial infrastructure powering internet knowledge sales, software distribution, and membership communities as consumer spending increasingly favors digital creators over traditional streaming bundles. The rapid emergence of AI-assisted vulnerability discovery exposes a widening gap between automated offensive capabilities and slow, manual enterprise patch cycles. While tech firms project unprecedented revenues around compute expansion, their timelines remain tied to resolving fundamental physical infrastructure limits and persistent web security deficits.

精炼阅读摘要

TBPN 节目探讨了由前沿人工智能挖掘出的大规模 PHP 底层漏洞引发的全球网络防御竞赛，并重点分析了 SpaceX 凭借算力扩张支撑的激进财务预期与科技行业近期资本动向。 AI挖掘PHP漏洞与全球应急修补竞赛 (2:27) 在 OpenAI 资助的开源代码审查中，安全机构 Calif 借助前沿 AI 模型发现了覆盖全球约 70% 网站的 PHP 语言严重内存管理漏洞“PHP 2 Shell”。该缺陷在代码库中潜伏数十年，此前被认为极难利用，但在 AI 辅助下已能通过几十次请求在数秒到数小时内接管服务器。Wiz 联合创始人 Ami Lutwak 称其为有史以来最严重的 AI 漏洞；PHP 基金会工程师 Volker 将其影响规模比作当年的 Heartbleed。为防范黑客利用 AI 逆向补丁，芬兰、荷兰和法国一度临时下线部分公共网络服务，日本首相亦公开发布紧急预警。由于相关细节提前在 Hacker News 泄露，原本协调由 Calif、Wiz、OpenAI 和 PHP 项目组推进的跨越近 200 个文件与逾万行代码的修复方案被紧急推向公众。OpenAI 的 Greg Brockman 指出未来需引入获授权的主动防御体系；OpenAI 随后通过开源仓库发布了 Codex 技能以协助自动化代码审查。与此同时，遗留系统更新迟缓令长尾网站持续承压，而 eMudhra 甚至曝出某 TLS 私钥仅为单个数字“4”且潜伏长达 18 个月的低级加密漏洞。 消费电子妥协与造车新贵航空争议 (11:15) 在硬件与高端制造领域，多款前沿产品面临市场与工程审视。iPhone Duo 评测机早期反馈严苛，Instagram、Google Calendar 和 Spotify 等应用均出现未适配的界面空白与巨大边栏。尽管彭博社 Mark Gurman 指出历史上新屏幕比例初期常有阵痛，但本次开发者提前一个月以上获得硬件真机却依然优化不足。此外，苹果为保持内屏无开孔视觉完整性而采用屏下前摄，导致自拍成像质量严重倒退，体现出鲜明的工程妥协。另一方面，获得特赦的 Nikola 创始人 Trevor Milton 进军私人飞机行业，但其静态展示飞机的机翼在展厅中被垂直立柱从下方支撑的画面引发强烈质疑，其既往造车履历导致高端买家对其设备安全可靠性存在严重信任危机。 SpaceX算力布局与合并特斯拉的商业构想 (16:42) SpaceX 在第三季度展示了激进的地面基础设施扩张。Starship 单次未满载发射部署的星链载荷已达 Falcon 9 的十倍。马斯克直言其数据中心工程能力堪比“纽约洋基队打少棒”，规划年内上线 2.5 至 3 吉瓦电力容量，并计划向 10 至 20 吉瓦推进。马斯克提出每瓦算力价值将随 AI 模型升级而持续增值，因而采取短期合同策略，在提高 Anthropic 和 Google 等客户租赁单价的同时，为未来的 Grok 模型储备内生算力。他预测到 2027 年底 SpaceX 年化经常性收入（ARR）可能达到 5000 亿至 1 万亿美元。这一系列动作重燃了关于 SpaceX 与特斯拉合并的讨论。ARK Invest 的 Brett Winton 认为，Optimus 机器人极度依赖超强智能，轨道算力前景也远大于自动驾驶出租车，二者合并有望冲击全球首家 10 万亿美元市值公司。不过，空头评论员 Hero Onoda 则警告该扩张路径过度承载前瞻炒作，企业存在杠杆过高与低质量收入风险。 资本市场承载力与AI产业竞合格局 (27:30) 美国资本市场近期展现出极强的资金吸纳能力，吸纳了包括 SpaceX 上市、谷歌股票增发、SK海力士海外募资、OpenAI 私募融资以及亚马逊发债等多项创纪录交易。在产业端，OpenAI 将旗下 GPT-6、Astra 和 Codex 等前沿模型上架 Google Cloud Marketplace，允许企业抵扣已有云额度，形成了竞合联盟；同时 OpenAI 收购了生物制药编排平台 Orchestra Bio。尽管 Citadel 的 Ken Griffin 警告目前处于 AI 泡沫之中，但他认为这预示着“创业的黄金时代”。在创作者经济方面，数字服务平台 Whop 完成由红杉资本和 Shopify 领投的 2 亿美元 D 轮融资，逐步确立其作为线上数字产品与社群商业操作系统的行业地位。 本期节目展现了 AI 正在重塑从底层安全攻防到算力基础设施估值的全产业链逻辑。然而，激进的万亿美元营收预期与现实中企业落后的修补速度形成鲜明落差，AI 驱动的超常规扩张能否在技术脆弱性与高杠杆风险中平稳落地仍待检验。

Source quotes

[5:00] Ami Lutwak: PHP 2 Shell is the most severe AI vulnerability that was ever found, and one that was likely too complex to have been discovered without AI. [5:00] Greg Brockman: As vulnerability discovery ramps we will need new defense solutions potentially including authorized defenders such as government, scanning the Internet for vulnerable hosts and either notifying or, in extreme cases, patching those systems remotely. [23:34] Brett Winton: Optimus's success is predicated on access to gobsmacking amounts of superintelligence. [16:42] Elon Musk: As you improve the AI software, as the models get better and better, you get more useful intelligence per watt, and the value of that compute is proportionate to the useful intelligence per watt.

Original transcript

[0:00] - We got bad news for you. And then we have good news. The bad news is John is not here with us today. He is under the weather. Keep him in your thoughts. Prayers. We've never actually taken-- Sick days? Ever? Normally when we're sick, we just keep going. But John is really down and out. And we feel... like a ship without a sail. Yeah. A lighthouse without a light. And we miss him dearly, but the show must go on. We have a great show. I got big shoes to fill. Huge shoes to fill. John is wearing an entire, all of John's clothing. He put his clothes on. Trying to keep it together. But funny enough, the suit doesn't actually look as comical as one might think. I was hoping that it would look even more exaggerated. It kind of just looks like a normal suit. Nathan Fielder, yeah. Not a workout-related illness this time. Just flu season. So stay safe out there. But big day today in technology. Of course, all the new vulnerabilities that we're finding out about, which are unfortunate. I was texting friends and family this morning, is well aware. But we have Nikesh Arora coming on in just 30 minutes from Palo Alto Networks. He's going to break it down. Going to break it down for us. So, yeah, we'll cover a few things, but wait to get into a lot of it with him. And then we have Aiden Smith from Flapping Airplanes coming on. They have a new $800 million round. And before I forget, let me tell you about Ramp. Time is money. Save both. Easy to use corporate cards, bill payments, accounting, and a whole lot more. You nailed it. You just missed the button. Yep. But we're working through it. Having some technical – there it is. There it is. Oh, okay. We're having some difficulties here. Yeah. I'll figure it out as the show goes on. Yeah, it makes it look so easy. But it's an art form, right? It truly is, yeah. It truly is. You can't even really be taught it. It's just kind of natural, I think. Totally. You're born with it. Yeah. Well... Let's pull up this video of John shortly before coming down with an element. Wow. Wow. Season got started and he wasted no time clip farming. - Yeah. Majestic. I hope he's watching this. I think he's sleeping. Anyways, let's go into PHP land. Tyler. You want to kick it off? Yeah, I mean, so PHP, obviously, like everyone knows, right, as you do. You know. Sorry. So something like 70% of all websites run on PHP. And basically there's this big vulnerability that was found in August. And now it's kind of coming out. There's a patch coming out. It should be-- I think it may have just come out. It didn't come out immediately when the actual news of the vulnerability happened, but-- Yeah, so this was discovered with 5.6. Yeah. Back in August. And so for the last couple of months, all the different companies involved have been trying to inform... as many people as possible. Yes. I'm trying to make sure that a lot of companies can get ahead of this before the disclosure. The big issue, I mean, my personal point of view is like, public companies, right? Companies that would have been in the loop over the last couple months. The bigger issue is the rest of the internet, websites that people have been... Yeah, I think there's going to be this kind of long tail of people that maybe are not that online, but they're running their own server from their local business that they've had up for 20 years or something. I think That's a scenario that is maybe a little bit more scary where you just have to really stay up on this stuff. Yeah, I've been thinking about all the different places that people... have input private information, things like social security numbers, I'm thinking like old, even like local government websites, right? All these different things. Feels like we're very close to, or effectively it's unavoidable that a lot of this stuff is going to leak out. So that's the bad news. Yeah, we've seen a lot of government websites like temporarily come down. I think Finland... They had some internet services that they took offline. Netherlands, France, similar. But hopefully throughout the day those will come back up because it seems like... the main patch has now come out. So the issue dubbed PHP 2 Shell represents a class of problems in the way PHP manages a computer's memory. It can be exploited in many ways, some requiring just a few seconds by hackers who would use it to run unauthorized software on any unpatched web server. It is the most severe security issue that PHP has faced in more than a decade. According to Volker... a security engineer with a nonprofit foundation that manages the PHP project. He likened it to Heartbleed, a similarly widespread vulnerability that forced the global race to protect hundreds of thousands [5:00] of servers more than a decade ago. When security patches are released, it marks the starting shot in a race between defenders and hackers. Defenders have to test and install the software patches while hackers study the patches as a guide to find new vulnerabilities, looking to see what has changed and then devising ways of attacking those areas. But today's AI tools can do this work much quicker than any human, potentially making the process more risky, security experts say. Some dude on Twitter could take the patches and run AI against it and post some exploit script, said Ty, the chief executive of Calif, the security company that first discovered the issue. All hell will break loose. Is that good? The big bug. Ryan Austin, a researcher at Calif, uncovered the flaws with help from GBD 5.6 Sol, one of OpenAI's most advanced models from a couple months ago. During an audit of PHP's source code in August, OpenAI funded that and other audits, part of an effort by AI companies to help open source projects address software vulnerabilities now being uncovered by AI systems. The class of bugs had been hiding in PHP source code for years. Security researcher had flagged it as a problem area decades earlier, but the flaw had been considered too difficult to exploit and was largely forgotten AI found a way Austin figured out how to control the code that was running in the computer memory with as few as a few dozen requests to a server running PHP. On smaller system, the hack takes just seconds. A more complex one, it can take hours. On August 11th, Dung called PHP's leadership. There's a serious issue here, he said. I had this moment of, oh God, what are we doing now? Douche said, how do I communicate this. And then you calm down, you let the adrenaline flow through, and you get to fix it. Soon an informal working group had formed among security researchers and software engineers. They collaborated with software distributors and security companies figuring out ways to patch PHP to shell and prevent it from being exploited. Researchers from Google's Wiz cybersecurity team soon reached out with new exploits, which they had discovered independent of Califf. They were findings from OpenAI's research team too. AI is enabling well-meaning security researchers to find thousands of software bugs, overwhelming projects like PHP with a flood of issues that need patching. But PHP 2 Shell was viewed as a priority and AI's proficiency at hacking prompted worries that criminals could exploit PHP 2 Shell. We need to figure out how to, we need a nickname for that It getting a little long Heartbleed that other Yeah that name goes hard PHP2 Shell doesn sound very scary Yeah it just sounds like some mumbo jumbo Keeping the secret, PHP2 Shell is the most severe AI vulnerability that was ever found, and one that was likely too complex to have been discovered without AI, said Ami Lutwak, Wiz's co-founder. Dung and the other researchers kept its existence a closely guarded secret while they worked on fixes for fear that an AI-aided hacker might find and exploit it before they were done. Really crazy that this was kept a relative secret for this. Yeah, well, actually, I think the original release of this was supposed to be tomorrow, and then details started to leak, I think, a day or two ago. And so it actually did. Right at the very end, it started to leak. But yeah, while they were working on it, it's great that they were able to hold on to this. The patching effort was massive. There are close to 200 files being fixed, and developers wrote over 10,000 lines of code during the process. should have called Gary Tan. He could have ripped that 10,000. G-Stack could have done that in a day. In a day. I mean, yeah. Maybe hours. Eventually a patch was set October 22nd. Then the inevitable happened. News of the patch leaked out Tuesday in a post in Hacker News Fitting for it to go out on a site called Hacker News Greg Brockman had a good post about this One interesting kind of tidbit that people are pointing out I can read it here As vulnerability discovery ramps we will need new defense solutions potentially including authorized defenders such as government, scanning the Internet for vulnerable hosts and either notifying or, in extreme cases, patching those systems remotely, which is very interesting. I mean, you can imagine some kind of service that basically they just, whenever anything happens, they have some sort of right access into your systems and can update them. Prime Minister posted, We have an urgent request for everyone to take action regarding PHP, which is used on many websites. The PHP security team has issued a warning about two critical vulnerabilities. Please check if you have publicly available websites that use PHP and prepare to apply the fixed patch that will be released tonight at 11 p.m. Japan time. It is difficult to apply the fix promptly. Temporarily suspending websites and similar measures can be considered an effective way to reduce risk." And Levels.io reached out to a friend. He said, I notified a friend working at a big tech company about the PHP vulnerability as their entire infrastructure runs on PHP. He answered, thanks, I'll try to patch it in a few days as I'm out of office now. And this is the modern tech. [10:00] Imagine the traditional companies running PHP. People won't update fast enough and the vulnerability will be out in the wild. Once the patch hits, as anyone can reverse engineer it based on the patch, Considering this, there's going to be so many sites hacked and so much user data exposed, I think. So... Yeah, not great. Also, I mean, we haven't covered this yet, but there's actually two-- vulnerabilities. There's a second one from eMudra, which is basically the TLS certificates that has the little lock on the browser. um Some of them had very trivial private keys. I think one of them was literally just number four. And so for contacts, the private keys are supposed to be, I think, hundreds of digits long, these numbers, and it's just number four. Not great. It is fascinating, though, that... But no one would expect number four. That's true. I looked it up. I think that had been live for a year and a half. And no one--seemingly no one like really did anything with it. So maybe kind of a white pill, actually. - Yeah, no one expects the number four. It's actually the smartest possible thing they could have done. - Yeah. - The most secure. OpenAI released a codec skill to help check whether your website is affected. They point your codecs at a GitHub repo that was just created, and it will guide you through it. So check that out or use your favorite Agent. Moving over to updates on Trevor Milton's new jet startup. I don't even know if it should be called a startup just because the company has been around for decades at this point. But a friend of the show, Preston Holland, was able to actually go to the event. I was quite bearish on this strategy. Trevor Milton's obviously been pardoned. He doesn't have a record anymore. He's free to do. and build whatever you want. I just think the strategy-- So he did nothing wrong. I'm not going to say that. Definitely not going to say that. But he is he's a free man. And again, I think the strategy of going into private aviation where you have super discerning buyers is just not probably a good business strategy. I still think you can make some argument where, you know, there's some kind of stigma discount that you can get on the plane because, like, if other people are worried about buying from him. That's a buying opportunity for me, right? others are fearful. Buy when others are fearful. I'm not. So I think this could-- there's some argument here. I think it makes sense. I think that's typically about investing, not relying on a machine for... you know These are investments. You could say in a way. . Right? Yeah, it depends on how much you value your time versus your life. But anyways, Preston got a good picture at the launch. The wings of the plane were propped up by posts. So is that normal? Now, maybe this is part of the innovation. Yeah, that's true. Yeah, very... I shouldn't say it's a huge surprise, right? you would think that they'd have more confidence that the Wings... of the demo aircraft would be able to just support themselves, right? Considering they're meant to support the entire plane in the air. But coming from the push the truck down the hill guy... I can't say. I'm that surprised. The main complaint with the iPhone Duo, people are getting their hands on the iPhone Duo, there's some reviews coming out. and There seems to be a lot of complaints. The big one being app optimization. Let's pull up this image. We can scroll. Down. you can see how apps that you might use frequently like Instagram or Google Calendar or Spotify. This looks like a Rivian app. and Also, internet speed check. Anyways, not dialed yet. I do think that... I don't think this is necessarily going to be a huge... issue. I think this kind of thing will get fixed pretty quickly. Are you talking about the big sidebar? that's kind of Yeah. They could have a lot of that. So it's like, hey, we made a phone whose entire value prop is that it's a bigger screen. As of right now, and again, I expect this to get fixed. the extra real estate. Yeah. The core value prop is not being delivered on yet. Mark Gurman says, "The iPhone Duo reviews are some of the most brutal I've seen from an Apple product in a long time, Vision Pro aside, but I've been around long enough to remember the iPhone 5. 6 Plus, and iPhone X. The app optimization issue is a non-issue and will be resolved in weeks. The one big difference I'd add the iPhone 5, And iPhone 6 Plus gave developers one week of turnaround time, though they've had a month plus and hands-on development opportunities with the Duo. Mm-hmm. I don't know what... Google and Instagram and Spotify are doing if they've had the ability to Yeah. They've had a month? They've had roughly a month. But maybe they're just bearish on the duo. Well, I think for Instagram or whatever, they probably assume that people are going to be kind of, they're going to have to, [15:00] wider, so you can get kind of dual-wheeled REELS? So they're probably optimizing for that. DAN GALPIN: Yeah, I do want to see what it looks like on Instagram when you have the two screens. DAN GALPIN: Yeah. And so I think these are starting to be delivered on Friday. I believe. The 23rd. So we'll start to get some. Yeah, but somehow people have them out in the wild now. So MKP-- Well, this is MKP review, yeah. I assume that he-- Get it early. Let's pull up this video from MKBHD. It is bad. photo quality of that selfie camera. Yeah, that is very first gen. And it is bad. The photo quality-- is trash. It looks a little better on like a FaceTime call with video than just straight up taking pictures with it, but Yeah, Apple clearly has done the math. Like they've assumed people won't use this camera very much and they've accepted the trade-off. of image quality. versus having this big, dramatic, uninterrupted inner display. We'll see that selfie camera. Yeah, I think that's a reasonable trade-off. And the camera is effectively invisible? Yeah. Which is extremely impressive. Yeah. This makes me more bullish on this. Yeah, it seems like a pretty good experience. Yeah. I did not get one. But... Do you want to? I could imagine other people enjoying it. You're not going to get one. I could get one if we needed somebody on the team. I could, yeah. to make a sacrifice and do it. Zach was. I would sacrifice myself. I mean, because you're going to have a massive aura loss. That's true, yeah. You can't be sinful on this thing at all. Cracking it open. I mean, John really does need to do it. He's the newspaper guy. yeah yeah I think he's got to do it. So I don't think you should have to. It's time to talk about SpaceX, SI, Tesla. SpaceX had their Q3 earnings call yesterday. um, It is one of the cooler earnings call experiences, even like the countdown, like the imagery that they have just show why the company ultimately trades. in a somewhat detached way from... business fundamentals, but they talk about the progress that they've made over the last quarter. With Starship specifically, the stat that stood out is that one starship that was not even full... is launching the equivalent of 10 Falcon 9s worth of Starlink. satellites, right? So it just shows shows how big the payload capacity can be And And again, they're just like going... as down the line as fast as possible to get to not just reusability, but rapid reusability. So that's What they're telling people to watch out for over the next quarter is, A lot of the call was focused on the terrestrial compute build out, Elon compared SpaceX and the team there, um, to the other sort of like cloud or neocloud players as... This is like the New York Yankees playing in the Little League. So not mincing words. And yeah. The big numbers that stood out They're talking about two and a half to three gigawatts online by the end of this year. with-- and pacing to get 10 online next year That being said, he did... He did... leave possibility for getting to 20 gigawatts next year. The logic there being like they are building out more... um Like they're trying to get enough effectively infrastructure in place to support 20 gigawatts, even if they don't actually have the power yet. Yeah. And then, I mean, he kept hinting or vaguely... circling around some kind of merger between Tesla and SpaceX. a lot of the news about right now. Yeah, before we get into that, we can talk about, let's pull up this clip of him talking about AI demand. Our belief is that the value of compute per watt will increase over time, not decrease. uh... And the reason for that, I think it should be obvious to people really, is that As you improve the AI software, as the models get better and better, They're able to you get more useful intelligence per watt. and the value of that compute is proportionate to the useful intelligence per Y. And that's why you see things like Even old-time, computers like H100s. renting for more than they rented when they were new. I'm And-- [20:00] I think that's likely to continue. I think we're going to face a shortage of superintelligence compute. And that shortage is going to remain for a long time. So-- So I think the smart move is to do short-term contracts and to And essentially, to place the bet on useful intelligence for what-- increasing rapidly, which obviously is done so that's what's happened so far. That's why I posted that sort of I think it's a good question. video meme of the Monty Python Cheese Shop Sketch. where the guy goes into a cheese shop to get some cheese and they actually have no cheese. And so he goes, what about this kind of cheese? What about that kind of cheese? And... They really just don't have any cheese. So-- We've actually tried to offload Trying to explain a meme. It's got no cheese. training. And we get the cheese drops again. Yeah, I mean, so presumably those short-term contracts he's talking about are the anthropic ones, right? It's interesting that he... keeps saying like short term contracts. Um... because I think... Yeah, people were... That's how people have been making the bear case around their compute business is like, okay, like this is a, you know, temporary solution. for companies like Anthropic and Google that are compute constrained, but these contracts will roll off and... the demand will shift somewhere else. And what he's saying is like, no, this is intentional. Yeah. We're doing this because we want to basically every year raise prices, raise prices because the expected value. of the compute will go up. I mean, or at some point, like... use that compute internally for Grok models. This is also like the meta-- Maybe a case where they'd have this big build out and like, Maybe they're making good use of it now, but at one point, people were like, oh, you should just resell it, become a NeoCloud. Yeah, so he definitely talks about GrokBot in the earnings call as well and says he expects most of their compute to go towards GrokBot. eventually. I THINK I'M GOING TO BE and talks about the growth there. The big line that stood out, which was funny, this came at the very end of Elon's segment before he... I'm not sure. past the mic to shot well. Let's listen to it. In a nutshell, what this implies for... SpaceX Um... annual recurring revenue by the end of '27 is somewhere between 500 billion and a trillion. Thank you. Thank you. Let's go. I mean, he literally nods. Oh, it's amazing. Big, big, big numbers. um, I guess in this case, it's funny, normally people would say annualized revenue run rate But he said, annual recurring revenue, but in this case, It actually could be. Maybe it's not. Yeah, it is annual. recurring revenue if they start continuing to stack these these like annualized deals. People are saying that Musk just saved the NeoCloud trade. with that line, "Our belief is that the value of compute per watt will increase over time Not decrease. Yeah, I mean, this is what, like, Semi Analysis has been saying for a long time, right? Right. The things just kind of keep going up. Yeah. Um, Brett over at ARK is talking about the merger. This seems inevitable at this point. Elon's pretty clear that it's going to be up to the shareholders on either side to decide. He believes it's the right move. And again, people, one of the biggest challenges of having SpaceX and Tesla is, both as public companies is like you can't drive all of that investor demand to one place and so you're trying to balance supply and demand for both assets. And again, this is a portfolio of existing. products as well as like, but the companies, both companies are valued on their future potential, right? Yeah. So combining them does make a lot of sense. I can imagine this as, it's not hard to imagine it as a sort of first $10 trillion company. Brett has a point of view on on the merger, he says on SpaceX versus Tesla, very crudely, RoboTaxi is a bigger opportunity than Starlink, but Orbital Compute is a much bigger opportunity Then, Robotaxi, an optimist requires more baking time than orbital compute. An optimist's success is predicated on access to gobsmacking amounts of Not a lot of people using that word these days. Maybe it's time to bring it back. Yeah, yeah. Amounts of superintelligence. the forced usage of superintelligence [25:00] ...by our industry has been pretty brutal to watch. It's really... I cringe a little bit every time. Elon responds and just says, interesting. This is... Obviously, his way of drawing attention to to things without giving them an endorsement in any way. So lawyers hate lawyers. Yeah, I mean, so many things here make sense, right? Lawyers hate this one. simple trick. They don't want you to know this. Yeah, the big thing is that Elon owns so much more of of SpaceX that he wants SpaceX to have the highest possible valuation and Tesla to have the lowest possible valuation at the time of the merger. What else? Hero Onoda says, I know Elon stocks get totally different treatment, but this is Oracle September 2025. Huge claims of future revenue, revenue extremely low quality, business about to become recklessly levered. So he's given the bear case here. Not Elon's first time making huge claims of future revenue. I think the interesting thing is like, even if he's off by five years. on these sort of revenue targets, like shareholders are still going to do pretty well. But yeah, very, very clear that, uh, They will be levering up in a way that no Elon company has before. outside of uh, XAI. Matthew Zeitlin says the American capital markets are the eighth wonder of the world. And he's quoting the economist. And it says in the past year, American markets have digested the largest ever initial public offering SpaceX. Equity raised by a public company, Google, or a foreign firm, SK Hynix, private funding round, OpenAI, and private debt deal, Broadcom, as well as most of the biggest bond companies. issue in history. Amazon, there was the first $1 trillion exchange traded fund or ETF. Vanguard, a record-breaking cash pile, Berkshire Hathaway and stock buyback program, NVIDIA, and consummation of the largest ever leveraged buyout, EA. The other crazy thing about a lot of these deals is they weren't even the current thing at the time. It was the kind of thing where it would be maybe get a mention on the front page of the journal or just be buried in... in the business section. um Big news today. uh, Somewhat unexpected, OpenAI models are coming to Google Cloud. um, to frenemies now, I guess, in many ways. OpenAI and Google strike major AI distribution deal. OpenAI will bring its frontier AI models, including GPT-6 Astra and Codex, to Google Cloud in the coming weeks. Enterprise customers will be able to purchase them through Google Cloud Marketplace using existing cloud spending commitments. The agreement follows OpenAI's expansion to AWS after its exclusive Microsoft distribution arrangement ended. In other news, OpenAI acquired Orchestra bio a platform that helps biopharma teams coordinate the complex process of drug development. Um, Rohendra goes to OpenAI absolutely massive news and super excited. for the team over there. I think it's a good thing. Ken Griffin. had some comments yesterday. He said, we're almost certainly in an AI bubble, but that sounds way more bearish than what he was actually saying. In his comments, he's talking a lot about-- disruption due to AI, but also said it would be A golden age of entrepreneurship. Let's go. So not all bad. I don't know if this is a serious comment or not. But let's see. Brian Johnson says, I have an AI agent that logs every negative comment someone makes about me online, then creates a profile of the person, maps all of their social connections, and finds all their emails. Tomorrow morning, my agent will send out an email blast to everyone's extended social network detailing the horrible things they've said about me. And he says, just kidding, it's not just to their social network, but to the extended network of everyone they know as well. I'm for real just kidding on all of this. I thought he would do it. I thought that was actually kind of an interesting-- experiment, just sort of narking on everyone. Narking on. It's probably millions, don't you think it would be millions of people? Yeah, I mean, if you include every Instagram comment, I think there's a long tail of these things. Yeah. Yeah. Pucco Capital says, some years ago, I just stopped logging into Netflix and never really thought about it again. Honestly, surprised. [30:00] It's still worth $275 billion. I read this and... And I agree. I think I still pay for Netflix. I never use it. I would... It's interesting to think about how much you would pay for YouTube versus Netflix. My willingness to pay for YouTube would probably be in the... thousands of dollars a year and uh I would probably take $1,000 in exchange for never being able to use Netflix ever again. Thank you. Yeah, I agree. So much of the content stuff is hard because Now, like 10 years ago or whatever, you don't have all the competing streaming platforms with like, oh, actually, my favorite show is on this, so maybe for this month we'll get this, and our family, you know... We can move over for a little bit to try this one. Um... I have not used Netflix in a long time. Oh, WAP raised $200 million in Series D funding. From Sequoia and Shopify. Very cool to see Shopify coming in. as a strategic And yeah, I think that in many ways WAP is... the Shopify for a whole new category of work on the internet. And, I think Steven and the team have been pretty consistently underestimated. by a lot of the market, but are extremely serious operators and have shown like massive ability to like be flexible and evolve with their customers, which... Yeah, the work that they're doing. in various forms, whether it's clipping, or courses is constantly evolving. But that's it. We did it. We made it through. But that's it. We did it. We made it through. We made it through. I've always said that if I wouldn't be podcasting if it wasn't for John, but... Nor would I. Nor would you. nor would any of us, but I'm glad we can do it. It's good. It's good that we can. We're not going to do it again. That's John's last sick day for the year. So as we head into flu season... Just remember, John. You already used your day up. It's over. Any final words? You remember what John says? Follow us on Apple Podcasts, Spotify, Spotify. YouTube. since we're after our newsletter. What else is there? I think that's it, right? Can't forget. Oh, how many days? Oh, yeah. What are we at? 64 days. We're right there. We're in the final stretch now. We're in the final innings. That's it, folks. Leave us five stars. Wow, really delayed flash. We love you guys. See you tomorrow.