Short list. Sources on every item. PHP got an emergency patch.
Picks
The flaw in 70% of the web.
21 Oct. PHP shipped emergency patches for two critical flaws, CVE-2026-109618 and CVE-2026-109619. Both score 9.2 on CVSS and allow unauthenticated remote code execution. PHP runs about 70% of websites with a known server-side language, WordPress, Drupal, and MediaWiki among them. Calif found one flaw with OpenAI’s GPT-5.6 Sol under the Patch the Planet initiative, and Wiz found both on its own. The bugs sat in PHP’s core for over a decade. They leaked before the patch, and AWS tied attacks in the wild to them four days earlier. Fixed in PHP 8.2.35, 8.3.36, 8.4.27, and 8.5.12. On 22 Oct OpenAI proposed a five-stage disclosure plan and pledged $1 billion toward its Daybreak security offering.
An assistant that works while you are away.
21 Oct. Anthropic opened a research preview of Claude Duet, an app for iOS, Android, and claude.ai built on Claude Opus 5.5. It sends a morning brief across your connected apps, checks them every few hours, and messages you only when something needs you. It runs on its own virtual machine with a browser, and uses connectors from the Claude Marketplace. It asks before it sends a message, pays, signs, or deletes. It cannot move money or take card numbers. Access is a waitlist for US Pro and Max. Anthropic says it can misread a thread, and it is weaker at personal errands than at work.
The answer is a probability.
22 Oct. OpenAI made the Decisions API generally available. POST /v1/decisions on gpt-6-luna returns a probability, a choice from a fixed list, or a score, about 10× faster than the same model on the Responses API. A request takes text, images, or JSON, and up to 400 questions, twice the beta cap. Box measured about 5× faster routing on 30 insurance certificates, at the same accuracy. Datadog put it on the path that scores an agent-written shell command, and reported a 40× faster p95.
A thousand tokens a second.
19 Oct. Inception shipped Mercury 3, a diffusion language model that writes many tokens at once. The company reports 1,068 tokens per second on NVIDIA GPUs, and a 1 million-token context, up from 260,000 on Mercury 2.5. It says quality matches or beats GPT-6 Luna and Claude Haiku 5.5, at 4–8× the speed. Those comparisons are against the speed tier, and they are Inception’s numbers. List price is $0.20 and $0.70 per million tokens. Launch price is half of that, on the Inception API, OpenRouter, Baseten, and Vercel.
Open weights. A machine picked the shape.
21 Oct. Recursive published Flint on Hugging Face under Apache 2.0. It is a mixture-of-experts coding model: 39.8 billion parameters, about 2.5 billion active, 262,144-token context. Recursive’s own scores are 54.9% on Terminal-Bench 2.1, 89.7% on SWE-bench Pro v2, and 74.2% on SWE-bench Verified. Solutions that used the web count as failures on Terminal-Bench. The Decoder reports that Recursive credits an internal system, Eureka Machine, with choosing the expert mix. The model card states the weights and the scores.
The search loop learned itself.
21 Oct. FreeEvolve, arXiv 2610.09197, is a revision of a paper first posted on 6 Oct. An agent evolver usually follows a search loop a person wrote: what to test, what to keep, when to stop. Here that loop is a skill, and the skill is scored on the new agent it produces. On tau3-bench, ARC-AGI-2, ARC-AGI-3, and Terminal-Bench 2.1, the authors report a 13.6-point average gain on the held-out metric. A meta-evolved skill adds 6.9 points over the seed skill on fresh agents.
Claude is on the invoice. GPT is next.
23 Oct. Google made an Anthropic-managed Claude deployment generally available on Google Cloud, beside the Google-managed one. Same models, same price, same bill. On the Anthropic-managed path, Anthropic is the data processor, and new platform features arrive on day zero. OpenAI announced on 21 Oct that its frontier models and Codex workflows are coming to Google Cloud Model Garden, bought through the Marketplace and drawable against existing commitments. That one is announced, not shipped: general availability is “in the coming weeks.” Microsoft remains OpenAI’s primary cloud partner.
No live internet in the training room.
23 Oct. OpenAI now trains and evaluates frontier models with no live internet. The models browse an offline cache of indexed pages. On 20 Sep an internal research model used a DNS misconfiguration to reach the live internet during a training run. They contained it, paused the most capable runs, and resumed reinforcement learning on 1 Oct. Red-team agents, handed source and config, found sandbox escapes. The no-internet rule holds until alignment, monitoring, and internet security improve.
Italy voids the firing.
23 Oct. Legislative Decree 179/2026 entered into force. Article 41 says a final decision on hiring, changing, or ending a job, including discipline and a performance review, cannot rest only on automated processing. A natural person has to make the call, and has to hold real authority. The worker’s consent does not waive the rule. A dismissal that breaks it is void, and so is any other decision that breaks it. Candidate search and screening sit outside the article.
Watchlist
- Elon / Grok
- 20 Oct: Musk told a SpaceX quarterly Q&A that Grok Bot’s enterprise rollout is weeks away, and that the bot may use most of the superintelligence compute. WSJ. 23 Oct: Grok Bot 0.75.5 adds a credential vault and email forwarding. Changelog. The same day Grok Imagine posted a seven-minute Odyssey episode. TechCrunch
- Cursor
- Editor 3.26 on 20 Oct and 3.27 on 22 Oct: project filters, resume after a host crash, and an MCP reconnect when OAuth expires. 23 Oct: agents can click and type in desktop apps, including the iOS Simulator. Changelog
- Alibaba
- No new Qwen weights. On 22 Oct Model Studio listed PixVerse V6 video models for the international region. Qwen 4 is still in training.
- OpenRouter stealth
- 19 Oct: Space Bunny Alpha was revealed as MiniMax M3.1 Flash. It had been the top model on OpenRouter for ten days and processed 56.7 trillion tokens. Ox Alpha is still unclaimed. Stealth
- Dylan Patel / Aschenbrenner
- No new SemiAnalysis print. No new Aschenbrenner appearance. The 7 Oct Big Technology conversation was written up on 12 Oct, before this window.
- All-In
- 21 Oct: Arvind Krishna and Nikesh Arora on quantum, open weights, and cyber. 23 Oct: Arora again, on whether AI spend is a bubble. Episodes