AI found a PHP hole. Patch it today

Hello again, and welcome to issue #2! 👋

This week AI stopped just writing code and started finding the holes in it, at internet scale. Plus a new kind of assistant, a big bet on open chips and a very cheap model. Five minutes, tops. Let's go.

📡 The Big Signal: AI finds critical PHP flaws, and everyone needs to patch

In short: two serious security holes in PHP, the language behind a huge share of websites, are now fixed. Update now.

On Wednesday (21 October), PHP shipped versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35 to fix two critical bugs (CVE-2026-109618 and CVE-2026-109619) that can let an attacker run their own code on a server without logging in. PHP's maintainers say every installation serving web requests is at risk, including PHP-FPM, Apache with mod_php and FrankenPHP, and that updating is the only complete fix. PHP 8.1 and older get no official update, so ask your vendor or upgrade.

The twist: security firm Calif found one of the flaws using OpenAI's GPT-5.6 Sol, as part of OpenAI's "Patch the Planet" programme, and Wiz found both independently. CISA, the US cyber agency, says it hasn't seen attacks yet, but urges organisations to patch immediately, starting with internet-facing systems.

Why this matters: if your website, shop or blog runs on PHP (WordPress does), ask whoever hosts it to confirm it's updated this week.

Sources: PHP security advisory · CISA · OpenAI

⚡ Quick Hits

In short: Anthropic launched an assistant that messages you first.

Claude Duet wants to be your proactive co-worker. Anthropic opened a waitlist research preview of Claude Duet, an app built around Claude Opus 5.5 that sends a morning brief, keeps an eye on your connected apps and works in the background on its own virtual machine. It asks your approval before it sends a message, makes a payment, signs anything or deletes something, and starts with US Pro and Max subscribers. Anthropic

Why this matters: AI assistants are shifting from "wait to be asked" to "tap you on the shoulder", so how much you let them see is becoming a real choice.

In short: OpenAI's models are coming to Google's cloud.

OpenAI lands on Google Cloud. OpenAI's frontier models and Codex agent workflows are heading to Google Cloud's Model Garden, with general availability planned in the coming weeks. Businesses will be able to pay for them from existing Google Cloud commitments, though OpenAI says Microsoft remains its primary cloud partner. OpenAI

Why this matters: if your company already runs on Google Cloud, using OpenAI's models may soon need no new contract.

In short: a RISC-V chip start-up raised $1.5 billion.

Tenstorrent more than doubles its value. Jim Keller's Tenstorrent closed a $1.5B Series E at a $6.2B valuation, led by Trace Capital and Innovation X. It will spend the money deploying its Galaxy servers at scale and growing the RISC-V CPU and AI chip designs it licenses to firms such as Samsung and LG. Tenstorrent

Why this matters: investors are paying serious money for alternatives to NVIDIA, which could mean more choice and cheaper AI hardware over time.

In short: a strong AI model that costs pennies to run.

MiniMax M3.1 Flash goes cheap. MiniMax released M3.1 Flash, a model aimed at agents, coding and computer use, priced at $0.15 per million input tokens and $0.60 per million output. The company says it is nearly three times faster than its predecessor and cuts the cost of agent tasks by 70%. MiniMax

Why this matters: when capable models cost this little, it becomes affordable to let AI handle long, many-step jobs.

🛠️ Tool of the Week: VegaLoad

In short: a free, open-source tool that checks your app copes with heavy traffic.

The founders of LitmusChaos have launched VegaLoad, an Apache 2.0 load tester that ships as one small binary for macOS, Linux, Windows, Docker and Kubernetes. It speaks 14 protocols (HTTP, gRPC, WebSocket, Kafka, PostgreSQL, Redis and more), has a built-in MCP server so Cursor or Claude Code can write and run tests for you, and can fail a pull request when latency or error limits are broken. Hosts other than localhost need your approval, and every run writes a single offline HTML report.

Why this matters: finding out your app falls over under load is far cheaper before launch day than during it.

👉 Read the launch post

💡 One Takeaway

Know what versions you're running. This week's PHP scramble was hardest for teams who didn't know where PHP lived in their stack. Keep a simple list of every language, framework and runtime version behind your projects, and subscribe to their security announcement lists. When the next "update now" lands, you'll know in minutes whether it's your problem.

That's issue #2! What did you make of it? Just hit reply: we read every message, and we'd love to know what you want more (or less) of.

And if Signal Tech saved you some scrolling this week, forward it to a friend who'd enjoy it. That's how we grow.

Until next Friday,
The Signal Tech team 📡
The tech that matters, minus the noise.