Friday 23 October

Hackers began probing the PHP2Shell vulnerabilities on October 17, 2026, four days before security patches were released on Wednesday. Amazon Web Services logged exploitation attempts against its MadPot honeypot and reports indicate the bugs are now being broadly exploited across the internet. Security teams are scrambling to remediate the two critical PHP flaws.

Why it matters: Unpatched PHP systems are at immediate risk of compromise, so rapid patching and monitoring are essential for tech professionals.

Ars Technica + 6 moreSave

Anthropic unveiled Claude Duet, a standalone AI agent that can monitor connected apps, prioritize tasks and act autonomously even when the user is offline. The app runs on Claude Opus 5.5, links to services such as Gmail, Slack and Stripe via more than 6,000 connectors, and requires user approval for sensitive actions like payments.

Why it matters: It shows how AI assistants are moving toward always‑on, task‑driven automation for professionals and small businesses.

The Decoder + 5 moreSave

Uber is deploying OpenAI's ChatGPT Work office‑task agent to more than 30,000 staff members, expanding from an earlier 1,000‑person pilot. The agent integrates with Gmail, Drive and Slack and runs on GPT‑6.1 Sol by default, aiming to help teams research, analyze data, create presentations and manage complex workflows.

Why it matters: Tech professionals should note how large enterprises are scaling AI agents for everyday productivity, signaling broader corporate adoption and integration requirements.

OpenAI News + 2 moreSave

OpenAI is in final talks to raise about $30 billion, targeting a $1.25 trillion valuation. The funding round is described as a bridge to the company’s planned 2027 IPO and is reportedly led by investors from the United Arab Emirates. If completed, the valuation would set a record for the most highly valued private company.

Why it matters: The scale of the raise and valuation signals massive capital inflow into AI, affecting market dynamics and competition for tech professionals.

Bloomberg Technology + 2 moreSave

SpaceX is negotiating with cellular infrastructure companies to obtain access to a minimum of 80,000 cell sites across the United States. The talks involve at least one major infrastructure firm, according to people familiar with the matter.

Why it matters: Securing thousands of ground sites could speed rollout of SpaceX's wireless network, impacting telecom infrastructure planning.

Bloomberg Technology + 1 moreSave

Apple's foldable iPhone Duo, priced at $2,000 and up, is facing short supply as demand surges. The company announced a purchase limit of two units per person. The restriction aims to spread availability among buyers.

Why it matters: Supply constraints and purchase limits affect device rollout plans for developers and enterprise buyers.

Bloomberg Technology + 1 moreSave

Two critical security flaws in PHP, used by an estimated 70% of websites, have triggered emergency cybersecurity measures in India, with banks auditing applications and the government patching official sites. Companies such as Razorpay have deployed AI‑led vulnerability detection and warned merchants, while Google, OpenAI and Amazon have issued responses to the threat.

Why it matters: The flaws highlight how AI‑discovered vulnerabilities can rapidly disrupt critical online services, demanding swift security action from tech teams.

CNBC Technology + 3 moreSave

OpenAI's GPT-5.6 Sol identified two critical PHP vulnerabilities with severity scores of 9.2, and security firm Wiz found the same flaws using Google's Gemini 4 Argon. The bugs could affect millions of websites, potentially up to 70% of the web, and fixes were coordinated after working exploits were demonstrated.

Why it matters: AI tools are now capable of discovering high‑severity software bugs, raising both security opportunities and risks for developers.

The Decoder + 2 moreSave

GitLab issued security patches on October 21 for a maximum‑severity regular‑expression compiler vulnerability that enables unauthenticated remote code execution. The flaw impacts every self‑managed GitLab release back to version 7.0, originally released in 2014. Earlier patches on October 12 covered only versions 19.2 and later, prompting the new comprehensive fix.

Why it matters: Unpatched GitLab servers can be fully compromised, risking code and data across countless development pipelines.

BleepingComputer + 2 moreSave