If you run a website, this week’s top story is not a product launch — it’s a patch. PHP itself has a critical flaw, Apple’s first foldable phone sold out in hours, and the AI assistant wars entered a new phase: agents that come to you before you ask. Here’s the week that was.
1. PHP2Shell: patch PHP itself, not just WordPress
Two critical flaws in the PHP engine — CVE-2026-109618 and CVE-2026-109619, collectively nicknamed PHP2Shell — let an unauthenticated attacker run code on a web server with a crafted request, before any application code executes. Both score 9.2 (CVSS v4.0), and the PHP project shipped emergency fixes on October 21: 8.5.12, 8.4.27, 8.3.36, and 8.2.35. The key point for WordPress owners: this is in the engine, not a plugin or theme, so updating WordPress alone does not fix it — your host or server needs the patched PHP build, and PHP-FPM or Apache needs a restart afterward. Attack traffic was already showing up before the patch shipped, so if you self-host, check with your provider today; PHP 8.1 and older get no numbered release, only source backports, so the durable fix is moving to a supported branch.
2. Apple’s first foldable arrives — and immediately sells out
The iPhone Duo went on sale Friday, October 23, and Apple’s first foldable phone lived up to the hype and the supply warnings: pre-orders opened October 16 and shipping estimates slipped to January 25 within about half an hour, while walk-in stock on launch day was limited and expected to sell out fast (Apple caps purchases at two per customer). The hardware itself is a book-style foldable with a 5.4-inch outer display and a 7.6-inch inner display, starting at $1,999 for 256GB and running to $3,199 for 2TB in Star White and Night Sky. Early hands-on reports praise the big-screen experience and flag the same caveat every first-generation foldable faces: plenty of apps haven’t been updated for the new form factor yet.
3. Claude Duet: the assistant that acts before you ask
Anthropic joined the proactive-agent race on October 21 with Claude Duet, a standalone app built on Opus 5.5 that sends a morning brief, watches your connected apps between check-ins, and surfaces things needing your attention instead of waiting for a prompt. It can draft replies, schedule meetings, and even build small web apps, but Anthropic says it still asks for approval before sensitive actions like sending a message, paying, signing a document, or deleting a file — and admits it can misjudge urgency. Duet is a waitlisted research preview for US subscribers on Pro and Max plans, using existing plan limits, with access via iOS, Android, and the web. The interesting question isn’t whether proactive agents work — it’s whether we’ll trust one enough to let it act while we’re away from the keyboard.
4. One London power event knocks out UK banks, courts, and couriers
On Tuesday, October 20, a power event in Google Cloud’s europe-west2-b availability zone — one of three zones in its London region — disrupted banking apps, card payments, and cash withdrawals at Revolut, Lloyds, HSBC, Halifax, and others, plus court video links and delivery networks across the UK. Google says services were restored the same day and it will publish an analysis after its internal investigation; European financial regulators are already asking questions, and UK MPs have demanded answers from the Bank of England and the FCA. The incident is the first major test of the UK’s Critical Third Party regime, which since July has put Google Cloud, AWS, Microsoft, and Oracle under direct financial-sector supervision. The homelab moral is familiar: a single region is a single point of failure, no matter whose logo is on it.
Sources: Reuters, Computer Weekly
5. GitHub Apps can finally replace your enterprise personal access tokens
GitHub made enterprise installations for GitHub Apps generally available on October 23, closing one of the last gaps that forced enterprise automation onto classic personal access tokens tied to individual employees. The new and expanded permissions cover enterprise repository policies and rulesets, two-factor requirements, verified domains, IP allowlists, and access restrictions, plus enterprise profiles, member privileges, and repository access settings. The same updates are planned for GitHub Enterprise Server 3.24. If your org still has automation running on somebody’s personal token — especially somebody who might leave — this is the migration to schedule, one workflow at a time, with only the permissions each workflow actually uses.
Source: GitHub Changelog
6. Meta’s new business terms take effect October 30 — read them before then
Meta’s updated Commercial Terms, effective October 30, authorize the company to crawl websites “associated with” a business account — anyone running ads, managing a Facebook Page, or using Business Suite — and use that content across its products, a clause originally reported as including AI training. Meta says the update consolidates existing language, does not change how its crawlers operate, and that site owners can still control crawler access through robots.txt; after publisher backlash it also softened the wording in the US version. The practical takeaway for anyone with a site linked to a Meta business account: check which domains are associated with your account and review your robots.txt before October 30, because the terms themselves offer no opt-out short of stopping business use of Meta’s products.
Sources: MadRobot, Dev.to checklist
If there’s a theme this week, it’s that the infrastructure underneath everything — the language your site runs on, the cloud region your bank sits in, the token your automation runs as — deserves as much attention as the shiny new device on top of it.
Disclaimer – As an Amazon Associate I earn from qualifying purchases, which helps cover the cost of keeping this site online.