PHP2Shell is patched, and an AI model found it first

On 21 October PHP released 8.5.12, 8.4.27, 8.3.36 and 8.2.35 to close CVE-2026-109618 and CVE-2026-109619, together called PHP2Shell, rated 9.2 out of 10. Attacks were seen before the release, after details leaked the day before. PHP 8.1 and older get no official fix. If you run PHP anywhere, check your version and patch today; the article also covers stopgaps for servers you cannot update yet.

The first flaw was found by Calif with GPT-5.6 Sol under Patch the Planet, OpenAI's program for open-source security, and Wiz found both on its own weeks later. OpenAI says it coordinated maintainers, researchers, hosting providers and government cyber agencies for 2 months before release. It also published a version checker as a Codex skill and guidance at patchtheplanet.org. When AI finds the bug first looks at what that head start gave defenders and how to use the same tools.

Microsoft says a China-aligned group it calls Storm-0940 has used ARTEX, an open-source multi-agent penetration testing framework, since September, and that some attacks went from first contact to privileged cloud access in under 3 hours. A password spray in mid-October peaked at 2,900 attempts a minute, and the campaign led to the ConnectWise Cloud Backup compromise. If you use ConnectWise, review sign-ins from at least 15 October with the queries in Microsoft's post.

Since 21 October Claude Security, in public beta for Claude Enterprise, keeps scanning connected repositories instead of waiting for someone to start a scan. It marks a finding fixed when the fix lands, reopens it if the bug comes back, and reads a knowledge base you write about how the code is deployed. Enterprise organizations get $25,000 in usage credits a month for 2 months.

Claude Duet runs on its own virtual machine with a browser, sends a morning brief, checks your connected accounts every few hours and asks before it sends, pays, signs or deletes. The research preview started on 21 October for US Claude Pro and Max subscribers, and it uses your plan's limits. How it compares with OpenAI's Dots, Meta's Muse and xAI's Grok Bot.

API version 2026-10-21 arrived on 21 October with new major SDK versions that send it by default: Python 2.0.0, TypeScript 1.0.0, Go 2.0.0, Java 3.0.0, Ruby 2.0.0 and more. Some breaking changes are in the SDKs themselves, whatever API version you send, and the SDKs move from the MIT licence to Apache 2.0. Pin your current SDK version until you have read Anthropic's migration guide.

Since 21 October an organization can choose which service tiers each project may use, or restrict them for every project. OpenAI lists the errors a request gets when its tier is not allowed, so check your error handling before an admin narrows the list.

If you resell Claude or run a gateway, user profiles (20 October) let you tag each request with the end customer it is for, so a safety action falls on that customer instead of your whole organization. Since 21 October each profile shows its enforcement status, and organization webhooks, in beta by request, tell you when a profile is restricted or banned and when that ends.

From 20 October an admin can turn off Claude's web fetch tool on the Console's Capabilities page, or limit it to allowed domains. Requests that still include the tool then fail with an error, and Claude Managed Agents now obey both the organization's domain rules and the agent's own. Inference hooks also left beta for Claude Enterprise.

The Responses API gained a 12-hour prompt cache on 20 October, for requests that share instructions and tools but arrive hours apart. Writing to this cache costs 2.5 times the normal input price, so it pays only when the same prefix is read again often enough within those hours. Our prompt caching calculator shows the same trade-off for Claude's 5-minute and 1-hour caches.