Thursday, October 22, 2026Memphis · 79°/49°, TennesseeEst. 2026
Markets · loading
Technology & Science
Technology
iTnews (Australia)
Emergency PHP patches issued for two critical flaws as attacks begin
Leaked 'PHP2Shell' bugs let unauthenticated attackers run code on web servers; Dutch government portals went offline as a precaution
The PHP project released emergency updates on October 21 for two critical flaws in the language itself, tracked as CVE-2026-109618 and CVE-2026-109619. Both are rated 9.2 on the CVSS v4 scale. They can let an attacker with no account run code on a web server. The fixes are in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, and the maintainers say only updating fully closes the holes. Details leaked before the planned disclosure, which forced the release forward. Cloudflare reported attack attempts hours before the patch, and watchTowr later said it saw active exploitation attempts. As of the latest update, no source had confirmed a break-in at a specific server. Techzine reported that Dutch government platforms, including DigiD, went offline temporarily as a precaution.
Why it mattersPHP runs WordPress, Drupal, Magento and a large share of the web, so a flaw in the language reaches far beyond any single application.
Australian court orders Apple to open iPhones to rival app stores
Judge Beach rules for Epic Games but refuses a worldwide remedy; Apple says it will seek a stay and appeal
SYDNEY — The Federal Court of Australia has ordered Apple to open iOS to rival app stores, direct downloads from websites and alternative payment systems for users with Australian Apple Accounts. Justice Jonathan Beach set out the orders in a 235-page remedies decision. Most changes take effect March 1, 2027, and Apple has until February 15 to ask for an extension to May 3. The orders also bar fees on purchases made through third-party stores and require Apple to readmit Fortnite and other eligible Epic apps. Apple won on some points. The judge rejected Epic's request for worldwide injunctions and let Apple keep security scanning and notarization requirements. Apple said it will ask for a stay and appeal. The decision follows the court's August 2025 finding that Apple misused its market power.
Why it mattersIt is one of the most far-reaching court-ordered openings of the iPhone outside the EU, and it adds to the global pressure on Apple's App Store model.
UK regulator proposes forcing Apple to loosen iPhone tap-to-pay controls
CMA wants rival wallets to get access on both main contactless standards, at fees it expects to be 'substantially lower'
LONDON — Britain's Competition and Markets Authority on October 20 opened a consultation on a conduct requirement for Apple's iPhone contactless technology. Apple currently offers UK developers only the secure element route, for a fee. The CMA would require access through both main international standards, secure element and host card emulation. It says its evidence shows neither raises inherent security concerns. The regulator will not set a price but has proposed principles for fees, and it expects them to fall well below today's levels. The CMA says contactless makes up 39% of UK payments, and no rival wallet has launched in Britain, unlike in the EU. Apple objects, saying the CMA should not require lower privacy and security protections. The consultation closes November 17, and the CMA will decide afterward.
Why it mattersThe proposal would use the UK's new digital-markets law against Apple's control of a key piece of iPhone hardware, and it could open the way to rival wallets, digital IDs and car keys.
Taiwan moves to make unauthorized AI chip exports to China a crime
Economy minister says advanced chips and AI servers will join the controlled-items list; no start date is set
TAIPEI — Taiwan plans to tighten controls on advanced semiconductors and AI servers bound for China, bringing its rules closer to those of the United States. Economy Minister Kung Ming-hsin told Bloomberg that the government will add the items to its controlled export list. Under the proposed framework, shipping restricted AI hardware to China without authorization could become a criminal offense under the Foreign Trade Act, giving Taiwanese prosecutors a tool they lack today. CommonWealth Magazine notes that the plan is a proposal, not a blanket ban. As of October 19, the government had not announced an implementation date or the full list of covered products. The move matters because most advanced AI servers are assembled in Taiwan, and diversion through the island has been a persistent enforcement gap for Washington.
Why it mattersTaiwan is the key assembly point for AI hardware, so local criminal penalties could change how effectively US export controls work.
AI-assisted discovery of two PHP flaws forces emergency patching worldwide
Researchers at OpenAI-backed Calif and Google-owned Wiz used frontier models to find and exploit bugs in the language behind roughly 70% of websites
PHP released emergency fixes on Wednesday for two critical bugs, CVE-2026-109618 and CVE-2026-109619, each rated 9.2 on the CVSS v4 scale. The patched versions are 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Wiz says every PHP release back to 5.4 is affected by at least one flaw. It demonstrated unauthenticated remote code execution against current WordPress, Drupal and Joomla images. Calif found one flaw using OpenAI's GPT-5.6 Sol during an OpenAI-funded audit, and Wiz independently found both, using Gemini 4 Argon, GPT-5.6 Sol and its own tool. Government sites in Europe went offline, and the NSA told operators to patch or disconnect. OpenAI says AI found the bugs before attackers did. A trade outlet reports Cloudflare saw early attacks after details leaked, and Cloudflare credits a fourth discloser, Quarkslab.
Why it mattersIt is the clearest real-world case of frontier models finding and weaponizing a flaw in core internet software, and it shortens the time defenders have to patch.
Meta lifts AI spending outlook and plans nonvoting shares to fund the push
Capital expenditure forecast now $135 billion to $145 billion as Asian markets fret over AI-trade sustainability
Meta raised the low end of its 2026 capital-spending forecast to between $135 billion and $145 billion, up from $130 billion to $145 billion. It also announced a new class of nonvoting shares. According to ABC News Australia's report, the shares could help finance acquisitions and attract talent without diluting Mark Zuckerberg's voting control. The company says its consumer agent Muse and a new series of models have helped justify the outlay. Some enterprises, however, are restricting the agent's access over security concerns. ABC also reported that Meta drew its largest-ever fine the same day, over Facebook privacy claims. Strong US tech earnings lifted Wall Street on Wednesday. Asia-Pacific markets fell on Thursday on concerns about the AI trade, with South Korea's Kospi down about 1.9%.
Why it mattersHyperscaler spending is the main test of whether AI revenue can justify the buildout, and investors are watching how it is financed.
OpenAI extends ChatGPT ads to 26 more countries, 89 in total
Free and Go users in Argentina, Peru, Nigeria, South Africa and Ukraine will see labeled ads
OpenAI said Wednesday it will bring ChatGPT Ads to 26 additional countries, taking the total to 89. Free and Go-tier users in places including Argentina, Peru, Nigeria, South Africa and Ukraine will start seeing them. The company says the ads are labeled, kept separate from ChatGPT's answers and do not influence them. That claim comes from OpenAI and has not been independently tested. CNBC reports the ad business reached a $1 billion annualized revenue run rate in August. OpenAI began testing ads in the US in February, a move rival Anthropic mocked in a Super Bowl campaign while pledging to keep Claude ad-free. OpenAI said it will develop more ad formats, measurement tools and buying options, and is exploring ways for businesses to interact natively with ChatGPT users.
Why it mattersAdvertising is becoming a core revenue line for the largest consumer AI service, and it sets up a business-model split with Anthropic.
Privacy World (Packard law-firm blog) midyear state AI update
State AI rules pile up as Connecticut law takes effect and Colorado comments close
Pennsylvania, New Jersey and Massachusetts are moving chatbot and frontier-model measures while Congress stays stalled
Connecticut's CART Act began taking effect Oct. 1. It protects employees of large frontier AI developers who report catastrophic-risk concerns, and it imposes duties on automated employment-decision tools. Its companion-chatbot rules start Jan. 1, 2027. Colorado's attorney general is taking comment through Oct. 26 on proposed rules for automated decision-making and conversational AI, including age assurance and protections for minors. The Pennsylvania House passed an AI chatbot safety bill, HB 2006, and an insurer-AI bill, HB 1925. Both are now in Senate committees. A New Jersey Assembly committee heard three AI bills on Oct. 19, covering content disclosure, liability and frontier-model risk. Massachusetts senators are weighing some of the strictest AI rules in the country inside an economic development bill still being negotiated. The Transparency Coalition counts 85 AI laws passed in 27 states this year. A law-firm survey says a Justice Department task force is challenging Colorado's law in court.
Why it mattersDevelopers face a growing patchwork of state obligations, with federal preemption unresolved and compliance dates arriving in 2027.
AI Buzz News for October 22 (note.com, Yasutake Ryota)
Notion says its agents can now run for more than 24 hours
Rebuilt agent infrastructure, a credit-based pricing model starting Nov. 2 and a cost claim that depends on the comparison
Notion announced that its AI agents can now work for more than 24 hours on a task, up from about five minutes. The release bundles rebuilt agent infrastructure, improved MCP support, a feature for connecting ChatGPT contracts and a new credit system that starts Nov. 2. Notion says that across more than 20 common use cases its Auto setting produced results comparable to Opus and Astra at an average of roughly 90% lower cost. That is the company's own figure, and its value depends on which models and workloads are the baseline. The details come from a Japanese independent AI newsletter summarizing the announcement, so the claims have not been tested by outside parties. How actual credit consumption compares with current spending will become clear after the pricing change.
Why it mattersLong-running agents move automation from short chat tasks toward unattended work, which raises questions about cost, oversight and review burden.
Lilly's oral GLP-1 pill matches insulin on heart safety in 2,749-patient trial
Lancet-published ACHIEVE-4 trial found orforglipron met its non-inferiority goal in type 2 diabetes, with better blood sugar and weight results
MILAN — A phase 3 trial published in The Lancet found that Eli Lilly's once-daily pill orforglipron (brand name Foundayo) was no worse than injected insulin glargine for major heart events. The trial, called ACHIEVE-4, enrolled 2,749 adults with type 2 diabetes at elevated cardiovascular risk. Most had established heart disease and more than a third had chronic kidney disease. Event rates for the four-part composite of cardiovascular death, heart attack, stroke and unstable-angina hospitalization were 4.2% on the pill and 5.0% on insulin, which Lilly reports as a 16% lower relative risk. The pill also lowered HbA1c and body weight more than insulin. About 10.6% of pill takers stopped treatment because of side effects, mainly gastrointestinal. The study was open-label and designed only to show non-inferiority, not superiority. It was presented at the European diabetes meeting in Milan and printed in the Lancet's Oct. 17 issue. Lilly funded the work.
Why it mattersThe result addresses the FDA's cardiovascular-safety question for an oral GLP-1 drug that could widen access to treatment for diabetes patients who might otherwise need injections.
Retracted Nature drought paper is followed by a study finding no recent acceleration
Oxford authors withdrew their 40% 'atmospheric thirst' claim over coding errors; a second Nature paper reportedly reaches a different conclusion
OXFORD — Nature retracted a June 2025 paper on Sept. 2 that said rising atmospheric evaporative demand, or 'atmospheric thirst,' had made global droughts about 40% more severe. The Oxford-led authors found a timestepping error that misparsed dates. They also found that an outdated evaporation-model version was used in a figure, and that global averages were not area-weighted. They say they will resubmit a corrected paper. They also say the conclusions hold, with a somewhat lower figure. The paper had been cited 337 times, according to Retraction Watch. A conservative legal blog reports that Nature has since published a separate paper. It argues that a common method overestimates evaporation losses and that drought trends show no significant acceleration across about 99% of land area. That second paper's findings have not been independently checked here. The corrected Oxford version is not yet peer reviewed.
Why it mattersDrought attribution feeds water, farming and insurance planning, and the episode shows how a single coding error can shift a heavily cited climate figure.
Skeleton in Westminster Abbey's Roman coffin likely a Saxon abbot, study says
Carbon dating and archaeology point to Ælfwig or Wulnoth; the identification is not confirmed
LONDON — A 150-year-old puzzle at Westminster Abbey may have an answer. A Roman limestone sarcophagus was recorded in 1869 with an inscription to a wealthy Briton named Valerius Amandinus. Its lid carries a Latin cross from the 10th or 11th century. Warwick Rodwell, the abbey's consultant archaeologist, reports in the peer-reviewed Journal of the British Archaeological Association, published Oct. 21. A full skeleton was found when the coffin was opened for conservation in 2016. Carbon dating places the bones between 987 and 1052. Specialist analysis estimates the man was 35 to 49 years old and about 5 feet 9 inches tall. Rodwell argues he was a high-ranking monk, probably Abbot Ælfwig, who died around 1020. Ælfwig's successor Wulnoth, who died in 1049, also fits. No name was recovered from the bones, so the identification is an inference.
Why it mattersThe study shows how a Roman coffin was reused for a prominent medieval burial and how modern dating can revisit old finds.
TechCrunch: SpaceX's AI business is beating expectations
SpaceX to try first catch of both Starship stages in November
Musk uses the company's earnings call to outline Flight 15, after Starship's first orbital flight last month
HAWTHORNE, Calif. — SpaceX will try to recover both stages of its Starship rocket with the launch tower's arms on its next test flight, which Elon Musk said is expected in November. He made the announcement on the company's third-quarter earnings call on Tuesday. No firm launch date has been published. Flight 14 on Sept. 28 was the first Starship to reach orbit. It deployed 26 next-generation Starlink V3 satellites. Musk called a double catch a major technology milestone but said the real test is flying both stages again. On the same call, SpaceX reported quarterly revenue of $14.58 billion, up 161%, according to Reuters. Starship has not yet entered commercial service. TechCrunch reported that Musk said he is spending four days a week in Memphis, where the company's Colossus II data center is under construction.
Why it mattersA successful double catch would be the clearest sign yet that Starship can be reused quickly, which both SpaceX's finances and NASA's Moon plans depend on.
NASA: Artemis III booster stacking and status update
NASA to update Artemis plans Friday as Moon Base rover work advances
Briefing at 2 p.m. ET follows hardware progress on Artemis III and new lunar rover awards
WASHINGTON — NASA will brief the public on the status of the Artemis program on Friday at 2 p.m. ET. Administrator Jared Isaacman, Associate Administrator Amit Kshatriya and Artemis program manager Jeremy Parsons will take part, according to SpacePolicyOnline. Artemis III, planned for 2027, will stay in Earth orbit. Its crew will rehearse docking with test versions of SpaceX's and Blue Origin's lunar landers. NASA finished stacking the Artemis III boosters, has installed all four core-stage engines, and plans a fuelling test at Pad 39B. NASASpaceFlight reports a target no earlier than June 2027. On Tuesday NASA also said it has awarded task orders to Astrolab and Lunar Outpost for the first crew-carrying lunar rovers, according to Xinhua. Blue Origin is to deliver them to the south pole by 2028.
Why it mattersArtemis III and the landers' readiness decide whether astronauts can land on the Moon in 2028.
Live Science: James Webb telescope discovers trove of metals around Milky Way's black hole
Webb finds unexpected heavy metals around Milky Way's central black hole
Gas near Sagittarius A* appears to share its makeup with nearby stars, researchers report
MONTREAL — The James Webb Space Telescope has detected a concentration of heavy elements in gas surrounding Sagittarius A*, the supermassive black hole at the center of the Milky Way, Live Science reported Wednesday. The researchers, led by McGill University doctoral student Nicole Ford, published their findings Oct. 19 in The Astronomical Journal. It follows earlier work in The Astrophysical Journal in May. The team says the metals most likely came from supernovas. The gas's composition matches that of several nearby stars, which suggests the gas and stars formed at about the same time. The result may help explain how heavy elements spread through galaxies. It also deepens a puzzle: the black hole takes in far less material, and more slowly, than other supermassive black holes.
Why it mattersThe finding ties the galactic center's chemistry to the origin of heavy elements, and it complicates efforts to explain why the black hole is so quiet.