Edition, Thu, 22 Oct 2026.

PHP2Shell: A leak in the disclosure process forces PHP's emergency fix forward, and attackers strike first

Two critical remote-code-execution flaws in PHP core are putting a huge share of the web on alert, with exploit attempts already observed days before the patches were publicly disclosed.

Two critical remote-code-execution flaws in PHP core are putting a huge share of the web on alert, with exploit attempts already observed days before the patches were publicly disclosed.

PHP released an emergency security update across the 8.x line on October 21, fixing two unauthenticated remote-code-execution flaws (CVE-2026-109618 and CVE-2026-109619), both rated CVSS 9.2. The vulnerabilities were discovered by Wiz Research in mid-August, but a leak on October 20 of the CVE IDs, with an incorrect release date and an inflated CVSS 10.0 score, pushed the PHP project to move the release forward a day to October 21 at 14:00 UTC. AWS Threat Intelligence had detected the first exploitation attempts on October 17, four days before public disclosure, and by the morning of October 21, proof-of-concept exploits from multiple distinct threat actors were already in the wild.

Upgrading PHP is the only complete remediation. AWS recommends investigating from October 17, not from the disclosure date, and if patching is delayed, blocking multi-part file uploads (the PHP_SESSION_UPLOAD_PROGRESS form field) is a mitigation. Given that PHP underlies WordPress, Drupal, and a large fraction of the internet, this is one of the widest-reaching web-security events in recent years.

Tesla begins making Optimus robots, and says it will sell Cybercabs by year's end

On its Q3 earnings call, Tesla announced early production of its humanoid robot at Fremont, while cautioning that the software is far from ready, and confirmed customers can buy the wheel-less Cybercab by December.

On its Q3 earnings call, Tesla announced early production of its humanoid robot at Fremont, while cautioning that the software is far from ready, and confirmed customers can buy the wheel-less Cybercab by December.

Elon Musk said Tesla has started early production of "production-quality" Optimus units on its high-volume Fremont line, with most of the equipment for a line targeting one million robots per year already in place. The target rate is 20,000 per week, at least a year away, and Musk expects to begin delivering robots to outside companies around the end of 2027. He acknowledged the robot's hands are not perfected, said Tesla is waiting for the AI5 chip (expected around April 2027, roughly 10x the compute of the current AI4), and described a fleet of 10,000 to 20,000 robots in an "Optimus Academy" that will learn through self-play. "There are like 10,000 things that have to go right," he said, "and it will move as fast as the slowest."

On the vehicle side, engineering vice president Lars Moravy said Tesla will start selling the Cybercab to customers by the end of the year, starting small. All units produced today go to Tesla's own robotaxi fleet. Musk also said unsupervised Full Self-Driving will reach existing customers in the second quarter of next year. Meanwhile, NHTSA has been investigating the Cybercab since last month, when it began operating on Austin streets, because current federal safety standards still require manual controls such as a brake pedal.

The UN concedes the 1.5°C limit is no longer in reach

For the first time, UNEP has acknowledged that keeping warming below 1.5°C above pre-industrial levels is no longer achievable, and is proposing to keep both the duration and the magnitude of the overshoot to a minimum.

For the first time, UNEP has acknowledged that keeping warming below 1.5°C above pre-industrial levels is no longer achievable, and is proposing to keep both the duration and the magnitude of the overshoot to a minimum.

On Wednesday, the UN Environment Programme acknowledged that the Paris-era goal is no longer viable, and is now framing the target in terms of minimizing both how long the world exceeds the limit and by how much. That will require dramatic emissions cuts now, plus the removal of hundreds of gigatonnes of CO2 from the atmosphere by 2100. The best case is an overshoot to 1.8°C accompanied by massive carbon removal.

The UN uses multi-decade averages to determine whether the threshold has been crossed, so technically the world has not yet exceeded the limit, but with the current strong El Niño event, the annual exceedance is almost certain. The 1.5°C goal was agreed in 2015 by all but two countries, and the US has alternately withdrawn from and recommitted to the agreement since.

Claude did not invent a scorpion antivenom

An investment firm and Anthropic ran an unreleased Claude model to design a scorpion antivenom from scratch, and got 17 promising protein binders but no actual drug.

An investment firm and Anthropic ran an unreleased Claude model to design a scorpion antivenom from scratch, and got 17 promising protein binders but no actual drug.

Citrini Research, an investment firm, partnered with Anthropic (in the run-up to an IPO) to test whether an unreleased, advanced Claude model could design a new scorpion antivenom. Bypassing Anthropic's biosecurity guardrails, the team worked in Anthropic's offices with a 35-page prompt and 300 subagents. Claude generated roughly 320,000 candidate proteins over a 64-hour design phase, narrowed to 211 designs, which were then tested at Adaptyv Bio (Switzerland) and Twist Biosciences (US). Anthropic covered about $50,000 of compute, and Citrini spent about $150,000 on lab testing. The result: 17 proteins that bound to 4 of the 5 target toxins, but no single protein bound to more than one.

Experts at the Technical University of Denmark and Khalifa University said that binding is only the first step, and that translating a binder into a safe, effective medicine remains the unsolved challenge. Neutralization, stability, safety, and behavior in the human body all remain open questions, and designing binders is close to a solved problem with conventional high-throughput screening. Citrini framed the exercise as a success for investment research rather than drug development.

An Anthropic team now says Claude writes 'literally all' of its code

On the eve of an IPO that could value Anthropic at nearly $2 trillion, a top engineer says human-written code has disappeared entirely from her 200-person platform team.

On the eve of an IPO that could value Anthropic at nearly $2 trillion, a top engineer says human-written code has disappeared entirely from her 200-person platform team.

Katelyn Lesse, who leads Anthropic's platform engineering group (core services, developer tools, and product infrastructure), said at Grafana Labs' ObservabilityCON on Tuesday that "all of our code is written by Claude. Like, literally all of it." Humans on the team still design systems and verifications, but the agents handle the grunt work of building, monitoring, and making changes. When the company ported a major codebase from Python to Rust, the workers built the verification approach and the agents did the rest. Anthropic already lets agents autonomously fix failing tests, and is considering agents making autonomous changes to the production codebase.

Company-wide, Claude has written more than 80% of Anthropic's production code since May, and the company's recent report says it has hired for a smaller share of junior technical roles as the agents take on more work. Heavy reliance on Claude Code helps Anthropic stay lean as it heads toward an IPO that could value it at nearly $2 trillion, though its revenue growth slowed in the third quarter.

ServiceNow and Nvidia launch Arc, an enterprise-governed personal AI agent

ServiceNow and Nvidia unveiled Arc, a personal long-running AI agent for everyday work that is governed by IT through the Super Intelligence Control Tower and enforced at runtime by Nvidia OpenShell, with end-to-end policy checks extending down to Nvidia's BlueField silicon layer.

ServiceNow and Nvidia unveiled Arc, a personal long-running AI agent for everyday work that is governed by IT through the Super Intelligence Control Tower and enforced at runtime by Nvidia OpenShell, with end-to-end policy checks extending down to Nvidia's BlueField silicon layer.

Arc, which went general availability on October 21, assigns goals rather than instructions and plans, executes, and checks its own work autonomously over hours or days. It surfaces action items from inboxes and meetings, builds integrations on the fly, and improves over time via memory and skills tailored to the employee. Governance is enforced through AI Passport, an attested record that defines which tools and actions each agent may use; Nvidia's OpenShell reads the passport at the software layer, while Nvidia Sentry and BlueField DPUs enforce revocation at machine speed in under a second, allowing revoked agents to be stopped without restarting shared infrastructure. The partnership targets the core enterprise AI challenge: giving agents real autonomy without losing control.

ServiceNow's AI contract value crosses $1 billion as AI Workflow Factory goes global

ServiceNow published a study on October 20 finding that 90% of organizations suffered an agentic AI security incident in the past year, a finding that bolsters its AI Workflow Factory product launched globally on October 6. The unified system bundles Process Mining, Build Agent, and App Engine with AI Control Tower governance into a single continuous improvement loop, enabling enterprises to scale workflow change in days instead of months.

ServiceNow published a study on October 20 finding that 90% of organizations suffered an agentic AI security incident in the past year, a finding that bolsters its AI Workflow Factory product launched globally on October 6. The unified system bundles Process Mining, Build Agent, and App Engine with AI Control Tower governance into a single continuous improvement loop, enabling enterprises to scale workflow change in days instead of months. An Autonomous Engineer tool in early access plans, builds, and tests implementation code without human intervention.

The broader numbers underscore the momentum: Q2 subscription revenue rose 24.5% to $3.88 billion, AI annual contract value surpassed $1 billion for the first time, and full-year subscription guidance was raised to $15.76–$15.78 billion, roughly 20.5% growth. The stock has climbed 43% over three months ahead of Q3 results due October 28, when analysts will look for continued cRPO growth near the 19.5% to 20% guide. ServiceNow also confirmed it has no interest in acquiring AI startup Decagon, reiterating an organic-growth strategy.

Experian and BT showcase divergent agentic AI approaches at ServiceNow World Forum London

Two major enterprises presented distinct paths to agentic AI adoption at ServiceNow's World Forum London this week.

Two major enterprises presented distinct paths to agentic AI adoption at ServiceNow's World Forum London this week. Experian, with 25,000 employees across 33 countries, leverages knowledge graphs and a data catalog to give agents contextual understanding across disparate sources before deployment. Its agents handle mortgage processing, HR onboarding, and risk management, each required to produce audit logs for compliance. BT, a critical national infrastructure provider, took a slower, people-first approach — upskilling thousands of data and AI apprentices and building security, governance, and observability as a foundation before deploying autonomous agents.

BT integrated AI into ServiceNow, Genesys, and Salesforce, cutting bid response time from 14 weeks to 3 minutes, and reported that roughly 50% of non-customer-impacting ServiceNow tickets are now self-healing. The company maintains strict human-in-the-loop policies for customer-facing operations but is experimenting with agentic self-healing in internal IT. Both cases underscore a growing consensus: agentic AI succeeds when paired with rigorous governance, clear boundaries on what agents may and may not do, and sustained investment in workforce readiness.