PHP's core engine gets its biggest security patch in years — and AI found the flaws
PHP, the language behind roughly 70% of websites, shipped fixes on October 21 for multiple memory-safety bugs in its core engine, including unauthenticated remote code execution; Wiz says every PHP release back to 5.4 is affected by at least one. Wiz found the flaws, and OpenAI says Calif separately found one using GPT-5.6 Sol as part of OpenAI's "Patch the Planet" effort, giving maintainers a head start before disclosure. OpenAI also committed $1 billion in subsidized access to its Daybreak security tooling for under-resourced defenders and released a PHP version checker as a Codex skill. Why it matters: the bugs were decades old and needed an exploit chain at the edge of what human researchers could build — frontier models are now lowering that bar for defenders and attackers alike.
Sources & depth
US orders civilian agencies to remove DeepSeek, as DeepSeek open-sources its inference stack
The Department of Homeland Security has ordered all federal civilian agencies to stop buying DeepSeek products and to remove them — and third-party products built on DeepSeek implementations — from their IT systems. Per press reports of the order (dated July 24, kept non-public until this week), it excludes military and intelligence agencies and does not say how DeepSeek open weights hosted by US vendors are treated. The same week DeepSeek released DeepInfer, an Apache-2.0 inference framework that runs its production serving stack, initially supporting DeepSeek-V4.1-Flash (kernels, expert parallelism, speculative decoding, batch-invariant inference); it passed 18,000 GitHub stars within days.
Sources & depth
OpenAI models and Codex are coming to Google Cloud
OpenAI and Google Cloud announced that OpenAI's frontier models and Codex agent workflows will be offered in Google Cloud's Model Garden, purchasable through Google Cloud Marketplace and payable against existing GCP spend commitments. The models will also arrive soon in Google Antigravity and the Gemini Agent. It is a notable multi-cloud shift for OpenAI distribution; no launch date, model list or pricing was given.
Sources & depth
NVIDIA at GTC Berlin: DSX POD factories, OpenShell agent safety, Vera Rubin on Google Cloud
NVIDIA's Berlin keynote on October 21 centred on Europe's AI buildout. DSX POD is a reference design for complete Vera Rubin AI factories assembled and tested in modular containers by 17 partners (Dell, HPE, Lenovo, Schneider Electric, Vertiv and others), with deliveries from early 2027; NVIDIA claims deployment at a prepared site can drop from six months to as little as 14 days. It also launched the OpenShell Reference Architecture for building and enforcing safe agents on enterprise and edge systems, and said Vera Rubin infrastructure is generally available on Google Cloud.
Sources & depth
MiniMax M3.1 Flash: cheap agentic model, weights promised later
MiniMax released M3.1 Flash through its API at $0.15 per million input tokens and $0.60 per million output tokens ($0.015 cached). It reports 73.7% on DeepSWE v1.1, 61.7 on OSWorld V2 and 82% on CyberGym, claiming first place among Chinese models on OSWorld V2 and Agents' Last Exam. Parameter count, context window and licence were not stated, and weights are only said to be coming "later" — these are vendor-reported scores, not independently measured.
Sources & depth
Anthropic: public-benefit equity fund, plus a reported $80B first-half loss
Anthropic announced the Anthropic Public Benefit Fund on October 18: subject to stockholder approval, 5% of its shares go to a new wholly owned LLC, rising by a further 2% at the board's discretion for every 50% increase in company value above a baseline; the equity may not be used for lobbying or political giving. Separately, press reports citing the Wall Street Journal say Anthropic recorded a net loss above $80 billion in the first half of 2026; Anthropic has not published that figure and the underlying article could not be read, so treat it as unconfirmed.
Sources & depth
Mistral ships Voxtral 3 speech and voice-agent stack; CERN partnership signed
Voxtral 3 is a family of speech models plus a voice-agent SDK that handles listening, reasoning, tool calling and speech output in one real-time pipeline: transcription in 50+ languages, text-to-speech in 35+. API prices start at $0.0035 per minute for batch transcription and $0.008 per minute for realtime; a licence was not stated. Mistral also signed a statement of intent with CERN for a strategic AI-for-science partnership.
Sources & depth