Postgres 19 slipped from late September or early October to about November 19 because AI review found defects faster than anyone could absorb them. The list was roughly 40 reports averaging a three-line fix, and the fix was never the expensive part: triage, patch, review, commit and backpatch overhead is paid per defect. Grant writing runs the same arithmetic one layer over. A researcher who cut a day a week of proposal work to 45 minutes still loses most rounds once rivals do the same, and fabricated citations in 2.5m biomedical papers rose 12-fold to about 0.5%, so the cost lands on reviewers. PHP2Shell adds the clock: a roughly ten-week embargo broke on one Hacker News post, and a patch of close to 200 files now doubles as a blueprint. Detection scales with compute, while remediation and review scale with maintainers and reading time, and release dates are quietly being set by the second number. Teams that fund the fixing, verifying and absorbing side tend to keep their dates; the ones that bought only the finder inherit a PG20-sized backlog.
The 3 reads that mattered most
Postgres is the week's cleanest measurement of what cheap detection costs downstream. GA moved to about November 19, 2026 and 8 to 10 significant features went back to PG20, after LLM-assisted review produced about 40 reports averaging a three-line fix. The quality bar rose after the features were written and committed, so finished work became work in doubt. Grant review and PHP's patch race follow the same pattern with different people absorbing the load. Watch PG20, which was expected to be bug-fix-only and now carries the leftovers; a verifier only pays off if remediation capacity grows to match.
Grants are the version of this problem with no checker at all, which is why the Economist piece matters beside the code stories. A typical application takes about 34 days and succeeds about 20% of the time, so a researcher cutting a day a week to 45 minutes still loses most rounds once rivals do the same. Fabricated citations in 2.5m biomedical papers rose 12-fold to about 0.5%, and ICML submissions doubled to 24,000, with the cost landing on reviewers. Where Postgres has committers and PHP has maintainers, science has reader attention, and no mechanical test to ration it. Triage and digest agents start to look less like conveniences and more like core infrastructure.
PHP2Shell puts a clock on the week's argument. Ryan Austin used GPT-5.6 Sol to take control of in-memory code in as few as a few dozen requests, in a bug class flagged decades ago and dismissed as too hard to exploit. The roughly ten-week embargo, from the Aug 11 call to the Oct 21 patch, broke on one Hacker News post, and a patch of close to 200 files now works as a blueprint. Finding was cheap for the researcher and the attacker alike; absorbing the fix across the long tail of unpatched servers is the slow part. For internet-facing open source, time-to-deploy is measured in hours, so mitigations have to ship before the diff does.