AI found PHP's critical flaws first — what to check this week: PHP 8.5.12, Railway and Claude Duet

Two PHP flaws — what is at risk and what to upgrade

PHP is a programming language that builds web pages on the server. WordPress, Drupal and Wikipedia run on it. On October 21, the PHP security team released 8.5.12, 8.4.27, 8.3.36 and 8.2.35, fixing two critical vulnerabilities (CVE-2026-109618 and CVE-2026-109619), and urged everyone to update immediately. A CVE is the international serial number assigned to each security flaw.

The risk is remote code execution: an outsider who has not logged in can make the server run commands of their choosing with a single request. The security team said every PHP installation that serves web requests (PHP-FPM, Apache mod_php, php-cgi, FrankenPHP, LiteSpeed) is affected, with mod_php at the highest risk because a demonstrated exploit fires before any application code runs.

Old versions are the problem. The flaws span roughly 20 years of releases, and PHP 8.1 and older no longer receive official updates. In an unusual step the security team published minimal source backports for 7.4, 8.0 and 8.1, but those require building from source or going through a long-term support vendor. It also listed temporary mitigations for anyone who cannot update right away, while stating that they do not make an installation safe.

Some old services that cannot be fixed have shut down. Two Japanese mobile games that ran for more than a decade said they will close because of the flaws, and the Internet Archive briefly went offline before coming back patched. Amazon's threat intelligence team said a honeypot monitoring system caught an attempt to exploit the flaws on October 17, four days before the patch. The PHP Foundation said it knows of no successful remote code execution yet but called updating imperative.

AI found it before attackers — OpenAI's Patch the Planet

How the flaws were found is the bigger story. On October 21, OpenAI said it had spent two months leading a coalition of maintainers, researchers and security providers to coordinate the PHP response. The security research team Calif found a critical flaw using OpenAI's GPT-5.6 Sol, and the security company Wiz independently found and reported both flaws. PHP's maintainers led the fixes and the release, while Cloudflare and others prepared protections ahead of disclosure.

OpenAI wrote that, to its knowledge, frontier AI found these flaws before attackers did. Frontier AI means the most advanced top-tier models. Finding them first opened time to fix and defend before disclosure, which OpenAI calls the Defender's Window. It also acknowledged that the same capability can help attackers build offensive tools quickly.

OpenAI expects similar findings to rise sharply in the coming months, proposed a five-stage process for responding to critical flaws in widely used software, and asked the security community for feedback. It also published a PHP version checker as a Codex skill. Codex is OpenAI's AI coding tool, and a skill is a packaged procedure you add to it. For anyone running services, it is a signal that a system for applying patches within days is no longer optional.

Railway's secrets incident — an attack aimed at the keys of AI services

On October 21, the app deployment platform Railway announced that it had detected anomalous activity in systems that store customers' environment variables. Environment variables are settings an app reads when it runs, such as API keys and database passwords; an API key is the string that lets a program use another service in your name. Railway said an unauthorized party may have accessed encrypted environment variables and, for some, obtained the decrypted contents.

Railway said it believes this is part of a series of attacks on platform companies aimed at compromising AI inference providers. Inference is the computation in which an AI model actually produces an answer, and inference providers sell that computation. Railway told those providers to revoke keys proactively and told customers to rotate every environment variable, API key and private registry credential stored in Railway and to review their logs.

New deployments were paused during the investigation. Code pushed in that window was not deployed, and Railway later advised redeploying the latest commit, reconnecting GitHub and recreating the credentials used by command-line and automated deployment tools. Even if you do not build software yourself, a service an agency built for you may run on Railway. If it used OpenAI, payment or database keys, the first step is to revoke them where they were issued and put in new ones.

Handing AI more — Claude Duet and Perplexity Computer

On October 21, Anthropic opened Claude Duet as a research preview. It is an assistant app that brings you what needs attention before you ask. It starts with a waitlist for Pro and Max subscribers in the US and runs in iOS and Android apps and on claude.ai. It is included in Pro and Max plans and shares the same usage limits as the rest of Claude.

It is built on Claude Opus 5.5. Each morning it sends a short brief on the most important items across connected apps; during the day it watches those apps and messages you only when something needs you. You can hand it anything from scheduling meetings to building dashboards and sales forecasts, and it checks with you before acting on your behalf.

Anthropic said Duet is designed never to see your passwords or sign-in tokens directly. A new classifier rejects requests to send the strictest tier of sensitive information, such as credit card numbers and government ID, and lets health or personal finance details through only when you explicitly instruct it. A classifier here is a separate AI judge that decides, message by message, whether to allow or refuse.

On October 20, Perplexity let its agent Computer run fully locally on the Mac. An agent is an AI program that takes a goal and works through several steps on its own, and local means the work stays on your own computer instead of going to the cloud. On Apple silicon Macs it runs Qwen 3.6 or PPLX Pro, a post-trained version of Qwen, and with permission it works across files and Mac apps such as Notes and Mail without sending personal data to the cloud. Tasks that need the cloud, such as searching for current information, are handed off only when you allow it.

Where AI gets blocked — websites shutting out agents, and Zoom's deepfake detection

The opposite trend has grown too. According to US tech press reporting on October 17, major websites are blocking AI agents that act for users. Yelp only admits agents that pay for its data licensing program, and Delta Air Lines prevents agents from booking tickets on users' behalf. JPMorgan Chase and Charles Schwab also confirmed they block agents from accessing accounts for security reasons.

When you pick work to hand to an agent, first check whether the sites that work passes through accept agents at all. The same week, Yelp added Check for Me inside its own app, which calls a restaurant for you, checks the wait time and texts you the result. It blocks other companies' agents while bringing in its own.

At its annual Zoomtopia event on October 20, Zoom announced deepfake risk detection, which flags in real time when a participant's video or audio may have been altered outside Zoom. A deepfake is a fake face or voice made with AI. It targets cases such as someone posing as a job candidate in an interview or impersonating a trusted vendor, and it shows suspicion with a confidence indicator. It is expected in December 2026. Zoom also announced AI management features that let admins see in one place what AI can access and generate across the company.

Also this week — Decisions API, locked ChatGPT chats, Voxtral 3 and Canva Craft

On October 22, OpenAI made the Decisions API generally available. An API is the doorway through which programs exchange functions. It handles questions whose answers sit within fixed options, such as classification, request routing and choosing the next action, using GPT-6 Luna, and the company says it is up to 10 times faster than calling the same Luna through the general Responses API. It doubled the limit to 400 questions per request and added the option to process requests only within the US or the EU.

On October 20, ChatGPT added the ability to lock conversations. You lock them with a four-digit PIN or with Face ID or Touch ID, and unlike Temporary Chats, which leave no history, locked chats can be reopened at any time. It is meant for moments when you hand your phone to someone else.

On October 22, Mistral released Voxtral 3, a family of speech models and a developer kit for building voice agents. It listens and speaks in more than 50 languages and calls other systems to handle multi-step work. It can be used through Mistral's EU-hosted service or deployed on your own infrastructure.

On October 22, Canva opened its first in-house image generation model, Canva Craft, to all users. Trained not on photographs but on Canva templates such as posters, social posts and presentations, it produces design images with legible text at up to 2K resolution, and the company says the results can be converted into layered designs for editing.

This week's checklist

First, check your PHP version. If your company runs a website, an online store or a WordPress blog, ask your hosting provider or development agency which PHP version it uses and confirm it is at least 8.5.12, 8.4.27, 8.3.36 or 8.2.35. If it is 8.1 or older, schedule the upgrade first.

Second, keep a list of the keys you have left in the cloud. Even if you do not use Railway, you cannot rotate keys after an announcement like this if you do not know which service holds which API key. Write the key name, the issuer and where it is stored on a single page.

Third, define the scope of an AI assistant. Before a tool like Claude Duet arrives at your company, separate what it may do without asking (organizing schedules, summarizing) from what it must confirm (sending, paying, sharing externally). For work you plan to automate with agents, also check whether the sites involved block agents.