DAILY AI BRIEF 🗞 — Oct 22

BREAKING 🔥:
- PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix two critical unauthenticated remote code execution flaws dubbed php2shell (CVE-2026-109618 and CVE-2026-109619), which OpenAI's Patch the Planet initiative helped uncover and now offers a Codex skill to check affected sites.
- Microsoft Threat Intelligence reported that China state-aligned threat actor Storm-0940 used the agentic AI penetration testing framework ARTEX to automate attacks on hundreds of organizations worldwide.
- Cloudflare warned that private keys for eight widely trusted eMudhra intermediate certificates were compromised, letting attackers forge certificates for any domain.
- Node.js shipped security releases for its 22.x, 24.x and 26.x lines fixing multiple vulnerabilities, including high-severity issues.
- Cloudflare warned that CVE-2026-88771 lets attackers run commands on NetScaler Gateway before anyone signs in.

ANTHROPIC 🔥:
- Anthropic opened a waitlist for Claude Duet, a standalone proactive agent app built around Claude Opus 5.5 that can also shop via Stripe Link and Shop Pay, for Pro and Max users in the US.
- Claude Security now re-scans connected repositories as code changes land, in public beta on Claude Enterprise.
- Anthropic released API version 2026-10-21 with new SDKs and ant CLI 2.0, now licensed under Apache 2.0.

OPENAI 🔥:
- GPT-6 Astra, GPT-6.1 Sol and GPT-6 Luna plus Codex workflows are rolling out in private preview on Google Cloud's Model Garden.
- ChatGPT Ads expanded to 26 new countries, with more than 100,000 advertisers on the platform so far.

SPACEXSI 🔥:
- Grok Bots are rolling out to X Chat, letting you message your bots like any contact without leaving the X app.
- Grok Bot can now build reports, memos and dashboards as live pages you can edit together or have it keep up to date.

GOOGLE 🔥:
- Gemini is now available in Google Maps navigation on CarPlay for parking, traffic reports and route changes by voice.

META 🔥:
- Meta reported $64.6B in Q3 revenue, up 26%, with Zuckerberg saying more than 25% of Muse users have bought items through the agent.

NVIDIA 🔥:
- At GTC Berlin, NVIDIA introduced the OpenShell Reference Architecture for securing enterprise agents and DSX POD, cutting AI factory deployment at prepared sites to as little as 14 days.
- NVIDIA released Nemotron 3.5 Embed, Rerank and Parse open retrieval models on Hugging Face.

MISTRAL 🔥:
- Mistral partnered with NVIDIA on AI for industrial engineering, covering faster simulation, open physics-AI benchmarks and agentic evals for CAE and EDA.

KLING 🔥:
- The Kling 4.0 API is now officially open, with the model also landing on Runway, fal, Higgsfield and Adobe Firefly.

COHERE 🔥:
- Cohere launched Rerank 5 in Pro and Fast tiers.

RECURSIVE 🔥:
- Recursive released Flint, a 40B MoE open-weight local coding model under Apache 2.0 that it says is up to 2x faster than comparable models.

* Used Grok to compose this brief, cherry-picking the news and doing some post-editing.