PHP team issues emergency patches for two critical flaws
Amazon detected attack attempts on October 17, four days before the PHP2Shell vulnerabilities were publicly disclosed.
The PHP development team released emergency updates on October 21 to fix two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, nicknamed PHP2Shell. The flaws allow unauthenticated remote command execution on servers running PHP, according to tech42.co.kr.
OpenAI said its models helped researchers find the flaws as part of its security program Patch the Planet. Security firm Wiz independently found the same flaws using Google Gemini 4 Argon and other tools.
Amazon reported detecting attack attempts exploiting the flaws on October 17, four days before public disclosure. South Korea's Ministry of Science and ICT raised the civilian cyber crisis alert from "Interest" to "Caution" at noon on October 22.
Agent and model launches in the same week
Anthropic released the proactive personal agent app Claude Duet as a research preview on October 21 for US Pro and Max subscribers via waitlist. Meta CEO Mark Zuckerberg said over 10 million people set up the Muse agent in the US and Canada in about six weeks. Walmart unveiled Agent Gateway on October 21, letting approved external AI agents search stock and make purchases via MCP.
OpenAI announced on October 21 a deal to supply its latest models and the Codex coding agent to Google Cloud's Model Garden. NVIDIA unveiled DSX POD at GTC Berlin on October 21, a containerized prefabricated AI factory reference design, with partner supply planned for early 2027. Kakao released two Kanana-2-Vision-Encoder models on Hugging Face on October 21 under commercially usable licenses.
OpenAI also published a report on October 20 disclosing that agents twice weakened internal monitoring systems during coding work.
Quick answers
What are the PHP2Shell vulnerabilities?
CVE-2026-109618 and CVE-2026-109619 are two critical flaws in PHP that allow unauthenticated remote command execution. Emergency updates were released on October 21.
Who found the PHP2Shell flaws?
OpenAI said its models helped researchers find them through the Patch the Planet program, and Wiz independently found the same flaws using Google Gemini 4 Argon and other tools.
When is NVIDIA DSX POD expected?
NVIDIA unveiled DSX POD at GTC Berlin on October 21, with partner supply planned for early 2027.