A PHP vulnerability dubbed “php2shell” was found using AI code-analysis and later patched, but hackers began exploiting it before public disclosure and millions of attempts followed after it went public. The PHP flaw affected an estimated 70% of the web, with a critical patch announced on Oct. 20 to be issued within 24 hours and active exploitation reported starting Oct. 17. Organizations now scramble to patch and some take services offline, while defensive AI programs like OpenAI’s Daybreak gain attention as companies pay to detect and fix code more quickly.
OpenAI made its Decisions API decision model widely available to customers, competing with TypeSafe’s Jev models as developers adopt faster, lower-cost option-selection workflows. The API targets latency of about 100–180 milliseconds and became available to all customers on Thursday. Developers can swap LLMs for higher-throughput decision models in use cases and improve responsiveness, while vendors also accelerate speed and add modalities like voice and visuals.
OpenAI donated the Open Responses API specification to the Linux Foundation’s Agentic AI Foundation (AAIF). The donation includes Open Responses and other frameworks, and AAIF launched in December 2025. Developers are expected to have a shared set of LLM API calls across providers, reducing provider-specific integrations for agent building.
Uber and OpenAI expanded their partnership by moving Uber’s entire workforce onto ChatGPT Work. The rollout covers about 30,000 employees, up from a 1,000-person pilot earlier this year. Uber will track how employees use it and adjust how it deploys AI across the business based on those outcomes.
OpenAI reported benchmark results for COBOL migration and multilingual code generation, saying its newest models improved both accuracy and cost. GPT-6.1 Sol scored 86.6% accuracy on its COBOL migration test at low reasoning effort, up from GPT-5.6 Sol’s 5.4%, and it reached 97.9% at higher reasoning effort. OpenAI says this should make COBOL modernization and multi-language software building more practical, though its COBOL test cases remain unpublished so outsiders can’t verify the results.
Hackers had a four-day head start exploiting the PHP2Shell vulnerability, which security groups say can enable access to a server’s file system or database. PHP was used to power about 70 percent of websites worldwide, and OpenAI said frontier AI found the flaws before attackers did and helped develop patches. Federal agencies and UK organizations were urged to assess impact and take systems offline or apply updates to fully mitigate the risk.
PHP sites were put offline as operators waited for fixes to two critical PHP flaws labeled CVE-2026-109618 and CVE-2026-109619. The PHP project released patched versions on 8.2.35, 8.3.36, 8.4.27 and 8.5.12, with older branches needing supported upgrades or distributor backports. The incident shifted focus to faster AI-assisted vulnerability discovery and a dispute over coordinated disclosure, changing how maintainers and vendors handle embargoes and patch timing for widely used open-source code.
PHP’s PHP2Shell vulnerabilities led major websites and services run by businesses, hospitals, schools, and government agencies to temporarily shut down or apply emergency protections as unauthenticated attackers could execute malicious code. Emergency fixes were released on Wednesday for PHP 8.2 through 8.5, with older versions largely unsupported and some legacy patches available. AI-enabled discovery has increased the pace of vulnerability reporting faster than maintainers can triage and patch, fueling disputes over coordinated disclosure and pushing for more preparedness, faster embargoes, and more support from companies and researchers.
Cybersecurity experts reported a wave of AI-accelerated vulnerability discoveries and exploit attempts, centering on a PHP flaw dubbed PHP2Shell and rapid exploitation activity seen before and after disclosure. Cloudflare observed attempts rising from thousands in the 10 hours before public announcement to millions within 2 hours. Patch timelines, disclosure rules, and the expected exploitability of flaws are becoming more difficult to predict as AI shortens the gap between bug discovery and attacker action.
Mark Zuckerberg described Meta’s plan for an autonomous network of AI agents that will handle tasks and communicate with other agents on users’ behalf. He said he is staking Meta’s future on Muse, released to the general public last month. As a result, Meta is positioning its AI agent product as the foundation for broader agent-to-agent activity rather than just standalone help.
A Nintendo Switch 2 jailbreak was demonstrated using an old game exploit and help from OpenAI’s Codex. On October 22, 2026, the modder showed the console running a custom Mario Kart World build with added playable characters. This changes what the console can run by enabling user mods and new character content through the jailbreak.
OpenAI, Anthropic, and Nvidia each reported their highest-spending lobbying quarter between July and September. Nvidia spent $2.2 million on lobbying during that period. The result is more concentrated influence efforts in federal policy as these AI companies respond to the importance of regulation.
OpenAI’s Patch the Planet and other security researchers identified and coordinated fixes for two PHP2Shell memory-corruption vulnerabilities with pre-authentication RCE and memory disclosure demonstrations against major CMSs. The effort involved about 2 months of coordinated remediation before disclosure, followed by scheduled patching guidance for 14:00 UTC with mitigations deployed earlier. Operators are prompted to upgrade PHP core across affected deployments and use detection/mitigation steps rather than assuming plugin-only fixes, while some leaked details and emergency shutdowns created operational disruption.
The article explains what forward deployed engineering (FDE) means at OpenAI.
No number, date, or benchmark is provided in the excerpt.
It clarifies the concept for readers, but the excerpt itself doesn’t add operational details beyond the definition.
PHP vulnerabilities were identified using AI tools and triggered a global cyber-security scramble as governments and agencies warned of urgent risk. The US National Security Agency told organizations using PHP to take systems offline if they could not patch immediately, citing a potential direct path to database exploitation. Authorities and website operators responded by distributing emergency patches, taking some sites offline, and monitoring for attacker backdoors and phishing.
OpenAI said it will make its newest large language models available in Google Cloud through Alphabet’s Model Garden service. Astra, its flagship GPT-6 Astra model, is paired with scaled-down GPT-6.1 Sol and GPT-6 Luna variants priced at 5 times and 100 times less per token than Astra. Google Cloud customers will also later be able to run the models on Confidential Compute infrastructure and access them via Antigravity and Gemini Agent offerings, with Astra and the other models generally available in Model Garden within a few weeks.
Uber is rolling out ChatGPT Work to more than 30,000 employees across the company. The rollout will reach over 30,000 employees. As a result, more internal teams will be able to use the tool for research, data analysis, presentation creation, and complex workflows.
Every AI story that matters,
in your inbox by 8am.
TLDRocket reads all relevant sources, removes duplicate coverage, and summarises the
day in two minutes. Follow companies and topics for alerts, or get the
briefing in Slack. Free, no spam, unsubscribe anytime.
Reading TLDRocket needs no cookies, and the readership counts we rely on come from
our own cookieless analytics. Google Analytics is the exception: it sets cookies and
reports to Google, so it stays switched off until you allow it. You can change your
mind any time from “Cookie settings” in the footer.
Strictly necessary
Session security and form protection (tldrocket-session,
XSRF-TOKEN, 2 hours). The site cannot work without them,
so they need no consent.
Always on
Google Analytics 4 (_ga,
_ga_<id>, up to 2 years). Measures which
stories and sections readers use. Google acts as a third-party processor and may
store the data outside the EU. No advertising, no profiling, no data sold.
