Automatically takes care of scaling, monitoring and security. It's time to talk about SpaceX. Si, Tesla SpaceX had their Q3 earnings call yesterday. It is one of the cooler earnings call experiences even like the countdown, like the imagery that they have just show why the company ultimately trades in a somewhat detached way from business fundamentals. But they talk about the progress that they've made over the last quarter with Starship. Starship specifically the stat that stood out is that one starship that was not even full is launching the equivalent of 10 falcon nines worth of Starlink satellites. So it just shows, shows how big the payload capacity can be. And again they're just like going as down the line as fast as possible to get to not just reusability but rapid reusability. So that's what they're telling people to watch out for over the next quarter. A lot of the call was focused on the terrestrial compute build out. Elon compared SpaceX and the team there to the other sort of like cloud or neo cloud players as this is like the New York Yankees playing in the little league. So not mincing words. And yeah, the big numbers that stood out, they're talking about two and a half to three gigawatts online by the end of this year with and pacing to get 10 online next year. Well that being said, he did, he did leave possibility for getting to 20 gigawatts next year. The logic there being like they are building out more like they're trying to get get enough effectively infrastructure in place to support 20 gigawatts even if they don't actually have the power yet. Yeah. And, and then I mean he kept hinting or vaguely circling around some kind of merger. Right. Tesla SpaceX, that's like a lot of the news about right now. Yeah. Before we get into that we can talk about, let's pull up this clip of him talking about AI demand. Our belief is, is that the value of computer per watt will increase over time, not decrease. The reason for that I think, I think it should be obvious to people really is that as you improve the AI software, as the models get better and better, they're able to you get more useful intelligence per watt. And the value of that compute is proportionate to the useful intelligence per watt. And that's why you see things like even old computers like H1 hundreds renting for more than they rented when they were new. And I think that's likely to continue. I think we're going to face a shortage of superintelligence compute and that shortage is going to remain for a long time. So I think the smart move is to, is to do short, short term contracts and to, and essentially to make, to place the bet on useful, useful intelligence for what increasing rapidly, which obviously is done. So that's what's happened so far. And also if you look at, say, how, how are our short term contracts renewing? Are they renewing at, at higher dollars per watt or lower? And we see them renewing at higher dollars per watt, not lower dollars per watt. We are also frankly hounded relentlessly by every hyperscaler and by dozens of smaller companies to rent more of our compute. So we could rent out our compute several times over if we said yes to everyone. That's just the situation here. That's why I posted that sort of video meme of the Monty Python cheese shop sketch where the guy goes into a cheese shop to get some cheese and they actually have no cheese. And so he goes like, what about this kind of cheese? What about that kind of cheese? And, and they really just don't have any cheese. So we've actually tried to offload some of our memes. They've got no cheese and we get the cheese shops. Yeah, I mean, so presumably those short term contracts he's talking about are the anthropic ones. Right? It's interesting that he keeps saying like short term contracts because I think, yeah, people were people. That's how people have been making the bear case around their compute business is like, okay, like this is a temporary solution for companies like Anthropic and Google that are compute constrained. But these contracts will roll off and the demand will shift somewhere else. And what he's saying is like, no, this is intentional. We're doing this because we want to basically every year raise prices, raise prices because the expected value of the compute will go up. I mean, or at some point like use that compute internally for Grok models. Right. This is kind of also like the meta maybe case where like, oh, they have this big build out and like maybe they're, they're making good use of it now. But at one point people were like, oh, you should just resell it, become a NEO cloud. Yeah. So he, he definitely talks about Grokbot in the earnings call as well and says he expects most of their compute to be to go towards Grokbottom eventually and talks about the growth there. The big line that stood out, which was funny, this was, came at the very end of Elon's segment before he passed the mic to Shotwell. Let's listen to it. I mean, in a nutshell, what this implies for SpaceX, annual recurring revenue by the end of 27 is somewhere between 500 billion and a trillion. Let's go. I mean, he literally nods. Oh, it's amazing. Big, big, big numbers. I guess in this case. It's funny, normally people would say annualized revenue run rate, but he said annual recurring revenue. But in this case it actually could be, maybe it's not. Yeah, it is annual recurring revenue. If they start continuing to stack these like annualized deals, people are saying that Musk just saved the NEO cloud trade with that line. Our belief is that the value of compute per watt will increase over time, not decrease. Yeah, I mean, this is what like seminal semi analysis has been saying for a long time, right? These things just keep going up. Yeah. Brett over at Ark is talking about the merger. This seems inevitable at this point. Elon's pretty clear that it's going to be up to the shareholders on either side to decide. He believes it's the right move. And again, people, one of the biggest challenges of having Space X and Tesla both as public companies is like you can't drive all of that investor demand to one place. And so you're trying to balance like supply and demand for both assets. And again, these are like, this is a portfolio of existing products as well as like. But, but the companies, both companies are valued on their future potential, right? Yeah. So combining them does make a lot of sense. I can imagine this as. It's not hard to imagine it as a sort of first $10 trillion company. Brett has a point of view on the merger. He says on SpaceX versus Tesla. Very crudely, Robo Taxi is a bigger opportunity than Starlink, but Orbital Compute is a much bigger opportunity than Robotaxi. And Optimus requires more baking time than Orbital Compute. And Optimus's success is predicated on access to gob smacking amounts. Not a lot of people using that word these days. Maybe it's time to bring it back. Yeah, yeah. Amounts of super intelligence, the forced usage of superintelligence by our industry has been pretty brutal to watch. It's really. I cringe a little bit every time on our modeling compared against the no merger case. Even if merged at the current share price ratio, Tesla shareholders would be 1.6 better off in 2031, while SpaceX shareholders would be 2 times better off. On a longer time frame. Tesla shareholders would be 5x better off having merged, whereas SpaceX shareholders would have been indifferent, would be more indifferent, 1.3x better off. So the Fair premium depends heavily on your time frame. On longer time horizon, SpaceX shareholders should be asking for a discount. On shorter time horizons, Tesla shareholders should be asking for a premium. But everyone is better off with a merged entity. A 30% premium paid on Tesla's share price today would effectively split the difference on the 2031 time frame. Tesla acquired at a 50% discount would equilibriate return differentials on the 2036 time horizon. Elon responds and just says interesting. This is obviously his way of drawing attention to to things without, without giving them an endorsement in any way. So lawyers. Yeah, I mean so many things here make sense right. Lawyers hate this one simple trick. They don't want you to know this. Yeah. The big thing is that Elon owns so much more of, you know of SpaceX that he wants SpaceX to have the highest possible valuation and Tesla to have the lowest possible valuation at the time of the merger. That being said, I think as soon as these companies are merged there's going to be way more attention put on just the, not even just Robo taxi but the car business like that we know the car business is ripping like anecdotally the Tesla's that the Tesla that you want to buy is probably has a multi month wait time and yeah I can't even like the sort of virality of Autopilot is like taking off in a way that I think would be getting way more attention from Elon were this merger not on the horizon. Yeah, definitely. What else hero Onada says? I know Elon stocks get totally different treatment but this is Oracle September 2025 Huge claims of future revenue. Revenue extremely low quality business about to become recklessly levered. So he's given the bear case here not Elon's first time making huge claims of future revenue. I think the interesting thing is like even if he's off by five years on on these sort of revenue targets like shareholders are still going to do pretty well. Yeah. But yeah very very clear that they will be levering up in a way that no Elon company has before outside of Xai. Yeah. Let me tell you about MongoDB. Please do. What's the only thing faster than the AI market your business on MongoDB don't just build AI own the data platform that powers it. Let's talk about you.

PHP land. Tyler, you want to kick it off? Yeah, I mean, so php, obviously, like everyone knows. Right. As you do, you know. Sorry. So something like 70% of all websites run on PHP and basically there's this big vulnerability that was found in August and now it's kind of coming out. There's a patch coming out. It should be. I think it may have just come out. It. It didn't come out immediately when the actual news of the vulnerability happened, but yeah. So this was discovered with 5.6. Yep. Back in August. And so for the last couple months, all the different companies involved have been trying to inform as many as people as possible. Yes. Trying to make sure that a lot of companies can get ahead of this before the disclosure. The big issue, I mean, my personal point of view is like, you're probably going to be fine using services from public companies, right? Yes. Companies that would have been there would have been in the loop over the last couple of months. Yeah. The bigger issue is the rest of the Internet websites that. Yeah, I think there's going to be this kind of long tail of people that, you know, maybe are not that online, but they, you know, they're running their own server from their, you know, local business that they've had up for 20 years or something. I think that's a scenario that like, is maybe a little bit more scary where you just like have to really say, stay up on this stuff. Yeah. I've been thinking about like all the different places that, that people have input private information, things like Social Security numbers. I'm thinking like old. Even like local government websites. Right. All these different things. Feels like we're very close to or effectively it's unavoidable that a lot of this stuff is going to leak out. So that's the bad news. Yeah, we've seen a lot of government websites, like temporarily come down. I think Finland, they had some Internet services that they like just took offline. Yeah, took offline. Netherlands, France, similar. But hopefully throughout the day those will come back up because it seems like the main patch has now come out. So the issue, dubbed PHP2 Shell, represents a class of problems in the way PHP manages a computer's memory. It can be exploited in many ways, some requiring just a few seconds by hackers who would use it to run unauthorized software on any unpatched web server. It is the most severe security issue that PHP has faced in more than a decade, according to Volker Douche, a security engineer with a nonprofit foundation that manages the PHP project. He likened it to heartbleed a similarly widespread vulnerability that forced a global race to protect hundreds of thousands of servers more than a decade ago. When security patches are released, it marks the starting shot in a race between defenders and hackers. Defenders have to test and install the software patches, while hackers study the patches as a guide to find new vulnerabilities, looking to see what has changed and then devising ways of attacking those areas. But today's AI tools can do this work much quicker than any human, potentially making the process more risky, security experts say. Some dude on Twitter could take the patches and run AI against it and post some exploit script, said Ty, the chief executive of Caliph, the security company that first discovered the issue. All hell will break loose. Is that good? The Big Bug Ryan Austin, a researcher at Caliph, uncovered the flaws with help from GPT 5.6 SOL, one of OpenAI's most advanced models, from a couple months ago during an audit of PHP source code. In August, OpenAI funded that another audit as part of an effort by AI companies to help open source projects address software vulnerabilities now being uncovered by AI systems. The class of bugs had been hiding in PHP source code for years. Security researcher had flagged it as a problem area decades earlier, but the flaw had been considered too difficult to exploit and was largely forgotten. AI found a way Austin figured out how to control the code that was running in the computer's memory with as few as with as few as a few dozen requests to a server running PHP on smaller system that the hack takes just seconds. A more complex one, it can take hours. On August 11, Deng called PHPS leadership. There's a serious issue here, he said. I had this moment of oh God, what are we doing now? Douche said. How do I communicate this? And then you calm down, you let the adrenaline flow through and you get to fix it soon. An informal working group had formed among security researchers and software engineers. They collaborated with software distributors and security companies figuring out ways to patch PHP2 shell and prevent it from being exploited. Researchers from Google's Wiz Cybersecurity Team soon reached out with new exploits, which they had discovered independent of Caliph. There were findings from OpenAI's research team too. AI is enabling well meaning security researchers to find thousands of software bugs overwhelming projects like PHP with a flood of issues that need patching. But PHP2 Shell was viewed as a priority, and AI's proficiency at hacking prompted worries that criminals could exploit PHP2 Shell. We need to figure out how to we need like a nickname for that. It's getting a little Long heartbleed. That other. Yeah, that name goes hard. Yeah, you're not php2 Shell doesn't sound very scary. Yeah, it just sounds like some mumbo jumbo. Keeping the secret. Php2shell is the most severe AI vulnerability that was ever found and. And one that was likely too complex to have been discovered without AI, said Ami Luttwak. Wiz's co founder Deng and the other researchers kept its existence a closely guarded secret while they worked on fixes for fear that an AI aided hacker might find and exploit it before they were done. Really crazy that this was kept like a relative secret for this. Yeah, well, actually I think the original release of this was supposed to be tomorrow and then details started to leak, I think a day or two ago. And so they pushed it out. Right at the very end it started to leak. But yeah, while they were working on it, it's great that they were able to kind of hold onto this. The patching effort was massive. There are close to 200 files being fixed and developers wrote over 10,000 lines of code during the process. Should have called Gary Tan. He could have ripped that 10,000. GStack could have done that in a day. Yeah, maybe hours. Eventually a patch was set. October 22nd. Then the inevitable happened. News of the patch leaked out Tuesday in a post in Hacker News. Fitting for it to go out on a site called Hacker News just under two days before the patch release. Douche's team decided to rush out the patch on Tuesday. They warned the world to stand by and expect a critical security update on Wednesday. It was a good balance to inform defenders and not give attackers too much time to develop exploits. So game time, a bunch of different. I think the Prime Minister of Japan has been posting about it and Nikesh, our guest coming on in roughly 15 minutes, said that's how you know it's serious. Yeah, Greg Brockman had a good post about this one. Interesting kind of tidbit that people are pointing out. I can read it here as vulnerability discovery ramps. We will need new defense solutions, potentially including authorized defenders, such as government scanning the Internet for vulnerable hosts and either notifying or in extreme cases, patching those systems remotely, which is very interesting. I mean you can imagine some kind of service that basically they just, whenever anything happens they are like have some sort of, you know, write access into your systems and can update them. Yep. Prime Minister posted. We have an urgent request for everyone to take action regarding php, which is used on many websites. The PHP security team has issued a warning about two critical vulnerabilities. Please check if you have publicly available websites that use PHP and prepare to apply the fix patch that will be released tonight at 11pm Japan time. It is difficult to apply the fix promptly. Temporarily suspending websites and similar measures can be considered an effective way to reduce risk and levels. IO reached out to a friend. He said, I notified a friend working at a big tech company about the PHP vulnerability as their entire infrastructure runs on php. He answered, thanks, I'll try to patch it in a few days as I'm out of office now and this is the modern tech company. Imagine the traditional companies running php. People won't update fast enough and the vulnerability will be out in the wild once the patch hits as anyone can reverse engineer it based on the patch. Considering this, there's going to be so many sites hacked and so much user data exposed, I think. Yeah, not great. Wildfire also, I mean we haven't covered this yet, but there's actually two vulnerabilities. There was a second one from Emudra which is basically the TLS certificate, right? You know, that has the little lock on the browser. Some of them had like very trivial private keys. I think one of them was literally just number four. And so, you know, for context, the private keys are supposed to be, I think hundreds of digits long. These like, you know, numbers and it's just number four. Not great. It is fascinating though that. But no one would expect number four. That's true. I looked it up. I think that had been like live for like a year and a half and seemingly no one really did anything with it. So maybe kind of a white pill actually. Yeah, no one expects the number four. Yeah, it's actually the smartest possible thing they could have done. Yeah. The most secure OpenAI released a codec skill to help check whether your website is affected. They point your codex at a GitHub repo that was just created and it will guide you through it. So check that out or use your favorite agent. NSA cyber is flagging concern as well. And again, this is the kind of thing that you want to be staying in tune with throughout the day because there's going to be more updates. Yeah. Let me tell you about Cisco. Critical instructor for the AI era Unlocks seamless real time experiences and new value with Cisco. Wow. Nailed it. That one was smooth. I think Jan's gonna get it. You're picking it up, you're natural. What else is going on? Sarah Guo says today's example of why AI people are legitimately stressed about Internet resilience in the face of agentic cyber attacks in 2026's ongoing Volpocalypse. Emudra's intermediate CA private keys turned out to be tiny numbers like and 56. We covered this already, she says, to make this more real. You think you're on IRS.gov there's a padlock next to the URL and all, but it's actually a scammer intercepting the connection, harvesting your SSN or bank details, then maybe forwarding you so you never notice. Good news is the browser's already blocked the bad certs. Bad news is a long tail of servers, containers and devices that still trust them has not one bad key generation script from 2025 is still forcing a heartbleed scale cleanup more to come. We have plenty of Internet wide security cleanup to do. Yeah, so I think this is really important for kind of the long tail of services, websites, stuff like that like we talked about earlier. I think, you know, if you're worried about within the coming days, like if you're. I don't. It doesn't make sense to be too worried about like logging into Instagram or whatever and having that be leaked. So you're saying get on reels. Yeah. Anytime that you might have been doing productive things on the Internet, stick to reels. Yeah. Let everything clear up. Hit the reels in the meantime, then poke your head out every now and then. Zoomer Cybersecurity advice Everyone.

NEWSMAX