Post
22 Oct 2026
AI helped find critical PHP flaws: patch now
PHP shipped 8.5.12, 8.4.27, 8.3.36 and 8.2.35 on Oct 21 to fix two critical vulnerabilities (CVE-2026-109618 and CVE-2026-109619, CVSS 9.2, nicknamed PHP2Shell by Wiz Research) that can allow unauthenticated remote code execution; all users should update immediately. Wiz says PHP powers 70% of websites and every version back to 5.4 is affected by at least one flaw; it demonstrated pre-auth RCE on WordPress, Drupal and Joomla, but the bug is in PHP itself. Calif found a critical flaw with GPT-5.6 Sol through OpenAI's Patch the Planet, and Wiz independently found both using Wiz Atlas, Gemini 4 Argon and GPT-5.6 Sol. PHP 8.1 and older no longer get updates (minimal source backports for 7.4, 8.0 and 8.1).
02AgentsAnthropic's Claude Duet agent works while you're away
Anthropic opened a research preview of Claude Duet (waitlist, starting with US Pro and Max subscribers): a standalone proactive agent app designed around Claude Opus 5.5. It sends a morning brief from your connected apps, messages you only when something needs attention, and keeps working on its own virtual machine with a browser while your devices are off. Before it sends a message, makes a payment, signs a document or deletes anything, it shows exactly what it will do and waits for approval; trading securities and moving money between accounts are off-limits even with approval. It can use 6,000+ connectors and plugins and never directly sees your passwords. Caveat: an early version that may misjudge urgency, and its background checks count toward usage limits.
Anthropic · claude.com ↗ (opens in a new tab)