Thursday, 22 October 2026
PHP Fixes Two Critical Flaws in the Language Behind Most Websites, and an OpenAI Model Helped Find One
PHP Fixes Two Critical Flaws in the Language Behind Most Websites, and an OpenAI Model Helped Find One
On Wednesday the PHP project shipped versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35 to close two critical flaws, both rated 9.2 out of 10, that can let an attacker run code on a server without logging in. PHP still runs an estimated 70% of websites. In one flaw, an out-of-memory error leaves request data half-built and the cleanup then trusts it; in the other, state from one request survives into the next request handled by the same worker. Apache sites running mod_php are most exposed: the project says a demonstrated exploit fires before any application code runs, and that only an update is a complete fix. OpenAI says a model from its Patch the Planet security programme helped uncover one of the flaws; the security firm Wiz found both independently. Within hours, watchTowr’s head of threat intelligence said attackers were already trying the holes — so far without success — and the NSA advised taking systems offline if they cannot be patched promptly. The machines that find the holes have got faster. The servers that need the patch are still waiting on a person with a free afternoon.
Source: PHP Group, October 21, 2026
Anthropic Unveils Claude Duet, an Agent That Keeps Working While You’re Away
Anthropic has opened a waitlist for Claude Duet, which it calls “a proactive agent that understands what needs your attention.” It sends a morning brief, takes tasks by message, “keeps working while you’re away,” and asks before “sensitive operations like sending messages or paying.” It runs on Opus 5.5 and is a research preview for Pro and Max subscribers in the US only; Team and Enterprise plans are not included yet. According to Crypto Briefing, it draws on the memory and skills already in a user’s Claude account, watches apps such as email and calendar, comes as its own iOS and Android apps, and its background work counts toward usage limits. Anthropic’s own warning is unusually plain: Duet “may misread a thread or miscalibrate what’s urgent.” Deciding what is urgent is the whole product — and the one part its maker says it may get wrong.
Source: Anthropic, October 21, 2026
OpenAI’s Models Come to Google Cloud
Google Cloud said on Wednesday that three OpenAI models are coming to its model garden: GPT-6 Astra for demanding coding, computer-use and research work, GPT-6.1 Sol for “near-Astra intelligence at lower cost,” and GPT-6 Luna, the fast, cheap one. They roll out first in private preview to selected enterprise customers. From day one, developers can also point their local Codex command-line and desktop tools at Google’s platform for inference. Billing runs through Google Cloud Marketplace, on one Google invoice, and draws down cloud commitments companies have already made; data-retention controls and confidential computing are “coming soon.” Google now calls itself the only hyperscale cloud offering all three leading closed models. Google and OpenAI compete for the same customers every day — now one of them prints the other’s invoices.
Source: Google Cloud, October 21, 2026