AI-found PHP flaws force emergency patches as OpenAI lands on Google Cloud

AI helps uncover critical PHP flaws, and patches ship worldwide

PHP's maintainers released emergency fixes on Wednesday 21 October for two remote code execution bugs, CVE-2026-109618 and CVE-2026-109619. Both carry a CVSS v4.0 score of 9.2. PHP says every installation serving web requests is exposed, including PHP-FPM, Apache mod_php, php-cgi, FrankenPHP and LiteSpeed. The risk is highest under mod_php, where a request without credentials can trigger the attack before any application code runs. The fixed releases are 8.5.12, 8.4.27, 8.3.36 and 8.2.35. There are also source backports for 7.4, 8.0 and 8.1.

OpenAI said the security team Calif found one of the flaws using GPT-5.6 Sol as part of its "Patch the Planet" coordination effort, and that Wiz found and reported both on its own. OpenAI has published a Codex skill that checks for vulnerable PHP versions. It also warned that the same model capabilities can help attackers write exploits. On the same day, Finland's state IT centre Valtori took the government's public websites offline as a precaution. It said it had seen no exploitation attempts.

What it means for NZ organisations: If PHP runs anywhere in your estate, including WordPress, intranets and vendor-hosted sites, ask your hosts and suppliers today whether they're on the patched versions. Expect AI-assisted bug discovery to shorten your patch windows from here.

OpenAI models and Codex come to Google Cloud

On 21 October, OpenAI and Google Cloud said OpenAI's frontier models and Codex are coming to Google Cloud's Model Garden. The listed models are GPT-6 Astra, GPT-6.1 Sol and GPT-6 Luna. They're rolling out now in private preview to selected enterprise customers, and OpenAI expects general availability in the coming weeks. Customers buy through Google Cloud Marketplace, so usage appears on a single Google Cloud invoice and counts against existing spend commitments. Google says Gemini for business and its Antigravity tool will get OpenAI models later.

What it means for NZ organisations: If you have a Google Cloud commitment, you may soon be able to use OpenAI models without signing a separate contract. Check data residency and pricing before you move workloads.

Anthropic previews Claude Duet, a background agent

Anthropic announced Claude Duet on 21 October. It's a proactive agent for claude.ai, iOS and Android. Duet sends a morning brief and checks connected apps every few hours. It can schedule meetings, build dashboards and prototype web apps on its own virtual machine while the user is away. Before it sends messages, makes payments, signs documents or deletes anything, it asks for approval. Some actions, such as trading securities, are blocked outright. It's a US waitlist preview for Pro, Max and Ultra subscribers.

What it means for NZ organisations: Agents that act across email and calendars are coming. Before staff connect work accounts to tools like this, set clear rules on what they can link.

Anthropic's draft federal safety bill draws scrutiny

Politico first reported Anthropic's confidential draft on 16 October, and analysis of it continued this week. The draft would let the US Commerce Department ask a federal judge in Washington DC to suspend a frontier model that poses an imminent threat. That covers three cases: bioweapons, loss of control and cyberattacks. Each threat must involve more than US$1 billion in damages or more than 50 deaths or serious injuries. Independent evaluators would register with Commerce and would have 72 hours to report a covered threat. It's a proposal, and Congress hasn't acted on it.

What it means for NZ organisations: US rules shape the terms of the AI tools New Zealand firms buy. Watch for transparency and incident-reporting duties that vendors may pass on.

Mistral and NVIDIA target engineering simulation

On 21 October, Mistral and NVIDIA announced joint work linking Mistral Large 4 with NVIDIA's CUDA-X, Warp and Omniverse tools to speed up engineering simulation. They plan public datasets and benchmarks that test AI agents on computer-aided engineering and chip-design tasks. Mistral Large 4 has about 1 trillion total parameters, 49 billion of them active. It was trained on 3,800 Grace Blackwell GPUs, and its weights are due at the end of October.

What it means for NZ organisations: Manufacturers and engineering consultancies should look out for these benchmarks. They'll give a fair way to compare AI agents before you trust them with design work.

DeepMind engineer resigns over military contracts

Google DeepMind research engineer Sofia Liguori resigned this week. The Intercept reported her departure on 21 October. She cited Google's military contracts with the US and Israel, including a classified Pentagon AI deal announced in April. Google said it runs public-sector contracts through a review process covering its AI principles and acceptable-use policies.

What it means for NZ organisations: How vendors handle defence and government work is becoming part of AI procurement. Include it in supplier due diligence if your stakeholders care about it.