PHP2Shell patching and CoreWeave's record credit spreads lead AI news

Two critical PHP bugs found with AI tools need runtime upgrades

Wiz Research found the first bug on 19 August. Its team had remote code execution working on Drupal the next day and on WordPress by 21 August. Wiz used its own Atlas tooling along with Google's Gemini 4 Argon and OpenAI's GPT-5.6 Sol, and it sent the findings to PHP's security team on 24 August. PHP published patches and the details on 21 October. CERT-EU gives CVE-2026-109618 and CVE-2026-109619 a CVSS score of 9.2 each. The patched builds are 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Wiz says every release back to 5.4 contains at least one of the bugs. The 8.1 line and older get no official releases, though source backports exist for 7.4 through 8.1.

OpenAI says it spent about two months coordinating researchers and security firms on the response. On 21 October, the FBI's cyber division told operators who couldn't update straight away to take their sites offline, and Finland's government website was only partly reachable that day. Cloudflare says its firewall began stopping exploit traffic at 3:02 am UTC, and CERT-EU records the PHP fixes going out at 13:30 UTC. Ismael Valenzuela of Arctic Wolf estimates that PHP runs about seven in ten sites where the server language can be identified.

What it means for NZ organisations: The bugs sit in PHP itself, so updating plugins or themes leaves them in place. Upgrade PHP on every server running WordPress, Drupal or Joomla, and ask your hosts to tell you which build they now run.

CoreWeave's default insurance costs reach a record

On 15 October, ICE Data Services data showed CoreWeave's five-year credit default swaps rising as much as 74.5 basis points during the day, to a record 1,194.5. In June they sat at 452. At that level, the market puts the chance of a default within five years above 60%. In Stockholm the same day, Nvidia chief executive Jensen Huang told Bloomberg that CoreWeave doesn't need a backstop from Nvidia, saying its strength was improving every day and its cost of capital was falling. Nvidia is CoreWeave's second-largest shareholder, with roughly a 10% stake.

On 20 October, Bisnow added more detail. CoreWeave shares had dropped close to 20% in a week, its 2030 bonds were yielding over 15%, and its 2032 notes were trading near 78 cents on the dollar. Its obligations come to about $50B: around $35B of debt and $16.3B of data centre leases. Microsoft, OpenAI and Meta brought in about 72% of its second-quarter revenue.

What it means for NZ organisations: Before you put GPU workloads with a neocloud, look at its balance sheet. Make sure your contract covers moving your data and leaving early.

Reservoir files lyric suits against Anthropic and Suno

Reservoir Media filed two separate complaints in federal court in Northern California on 21 October. The Anthropic case covers lyrics from 853 compositions, with statutory damages capped at $151.4M. The Suno case covers 1,050 songs and could reach $186.4M. Those figures are upper limits: Reservoir's main claim is for actual damages and profits. Anthropic told Billboard, "We disagree with the allegations and intend to defend this case vigorously." Suno declined to comment.

What it means for NZ organisations: If your marketing or content teams use generative tools, check what copyright indemnity each vendor's contract gives you.

AWS releases Continuum for code vulnerabilities

AWS made Continuum for code vulnerabilities generally available on 22 October in its US East (N. Virginia) and US West (Oregon) regions. It looks for flaws, checks which ones can be exploited in your environment, ranks them by business impact and drafts fixes as patches or pull requests. A person has to review and merge every fix.

In a 5 October post, AWS said Continuum finished 819 of 920 CyberGym-E2E tasks inside the 90-minute limit (89.0%), well above the previous public best of 65.9%. It repaired the exact vulnerability each task targeted 37.8% of the time. The benchmark tests memory-safety bugs in C and C++ projects only.

What it means for NZ organisations: Teams with C or C++ codebases can trial it from US regions. Treat its patches the way you'd treat a junior developer's pull requests, with a full review before merging.

Anthropic previews Claude Duet

On 21 October, Anthropic opened a waitlist for Claude Duet, a research preview for US subscribers on its Pro, Max and Ultra plans. Duet runs on Claude Opus 5.5 in its own app and on its own virtual machine. It sends a morning summary, checks linked accounts every few hours and can reach over 6,000 connectors. It can read and draft without asking, but it waits for approval before sending, paying, signing or deleting anything. Trading securities and moving money between accounts are blocked entirely. Anthropic says it may misread threads or misjudge what's urgent.

What it means for NZ organisations: Duet isn't offered here yet. It's a useful prompt to decide now which actions your staff will let an agent take without sign-off.

a16z Crypto becomes a16z Frontier

On 22 October, Andreessen Horowitz renamed its crypto unit a16z Frontier. Chris Dixon still leads it, and it'll now invest in AI, robotics and other emerging technology as well as crypto. Its newest fund, announced in May, holds $2.2B, and its five funds have raised $9.8B between them.

What it means for NZ organisations: Local AI and robotics founders who are raising money abroad now have one more large US investor to approach.