Two critical PHP flaws, one found with AI. Patch now.

Both flaws score 9.2 on the CVSS severity scale. They allow remote code execution without a login. The fixed versions are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP's advisory says updating is the only safe choice. OpenAI says security firm Calif found one flaw using GPT-5.6 Sol. Wiz found both flaws on its own.

• OpenAI's models are coming to Google Cloud. OpenAI said on October 21 its frontier models and Codex are coming to Google Cloud. Customers will buy them through Google Cloud Marketplace. General availability is planned in the coming weeks. Microsoft remains OpenAI's primary cloud partner.
• Anthropic previews Claude Duet. Anthropic opened a US waitlist for Claude Duet, a proactive agent app. It is for Pro and Max subscribers on iOS, Android and claude.ai. It asks before it sends messages, makes payments or deletes anything. Sixty Bytes is made with Claude.
• AI stocks had their worst day since July. The S&P 500 fell 1.2% on October 22, the AP reports. The Nasdaq fell 2.6%, and Nvidia dropped 4.4%. Lam Research fell 11.8% and CoreWeave 10.1%. The AP tied the slide to costly borrowing for data centers.
• Mistral and Nvidia team up on engineering AI. Mistral says its Large 4 model was trained on 3,800 Nvidia Grace Blackwell GPUs. The two plan open benchmarks for engineering and chip-design agents. Mistral says Large 4's weights are due at the end of October.