Four governments pulled public websites offline this week before a patch even existed, because AI-assisted research turned up two memory bugs in the language that runs most of the web. On the same days, a New Mexico judge put a $25 billion price on an eight-year-old privacy promise, OpenAI began selling its models inside Google's cloud, and two of the biggest names in AI moved agents closer to your inbox and your checkout. Here are the five stories that matter, each verified against a primary or reputable source.
AI found two PHP flaws and four governments pulled their websites
- Wiz Research disclosed two memory-corruption bugs in PHP — CVE-2026-109618 and CVE-2026-109619, rated up to 9.2 out of 10 — that allow pre-authentication code execution on WordPress, Drupal and Joomla. The team found and weaponized them with help from Gemini 4 Argon and GPT-5.6 Sol; the patched releases shipped on October 21.
- Before the fix landed, the Netherlands took its own National Cyber Security Center offline, along with the Port of Rotterdam, the Overheid.nl portal and several hospitals. Finland's state IT provider Valtori began cutting public traffic at 12:45 p.m. local time, Denmark's Kombit shut the national school platform, and France's Interior Ministry pulled local government sites. PHP runs about 75% of websites whose language can be identified, per W3Techs.
Why it mattersIf your business or your client's lives on WordPress with shared hosting, this is your flaw. Email your host today and confirm PHP has been updated — an unpatched version is an open door, and "nobody has attacked us" proves nothing.
A judge ordered Meta to pay $25 billion over Cambridge Analytica
- New Mexico judge Francis Mathew signed the $25 billion penalty on October 21, after a September jury found 43,899,720 willful violations of the state's Unfair Practices Act, tied to Cambridge Analytica harvesting data from more than 50 million Facebook users for 2016 political ads.
- Mathew started from the statutory maximum of $5,000 per violation — $219.5 billion — and cut it to $25 billion. New Mexico was the only state to take its claims to trial; the other 48 settled. Chief legal officer C.J. Mahoney called the suit "a tax on speech" and said Meta is confident it will prevail on appeal.
Why it mattersThis is the largest bill a social network has paid for lying about privacy, and it hands regional regulators drafting their own data laws a reference number. If you hold customer data, note what was punished: not a breach, but promising control that did not exist.
OpenAI starts selling its models inside Google Cloud
- Announced October 22: OpenAI's frontier models and Codex are coming to Google Cloud's Model Garden, bought through the Google Cloud Marketplace, and customers can apply the spending commitments they already signed with Google. General availability is planned in the coming weeks.
- OpenAI president Greg Brockman said the deal puts "our most capable models and Codex available where customers are already building," while Google Cloud CEO Thomas Kurian framed it as giving customers "a broad selection of models, including those from OpenAI." The models will also reach Google Antigravity and Gemini Agent, with no date given.
Why it mattersFor a company in the region already billing through Google Cloud, this removes the ugliest step: opening a contract and a payment method with another US vendor. Check whether your OpenAI spend can ride the commitment you already signed with Google and skip the banking friction.
Anthropic launches Claude Duet, an agent that messages you first
- Duet runs on Opus 5.5 and opened October 21 as a research preview with a waitlist for US Pro and Max subscribers, as a separate app on web, iOS and Android. It sends a short morning brief and rechecks connected accounts every few hours, messaging you when it judges something needs attention.
- It carries more than 6,000 connectors from the Claude Marketplace — Gmail, Slack, Stripe, Shopify, HubSpot, QuickBooks among them — and keeps working in a virtual machine with its own browser while your devices are off. It must get approval before sending messages, making payments, signing documents or deleting anything, and background checks count against your plan limits.
Why it mattersThe shift here is not intelligence, it is initiative: an agent that decides when to interrupt you. Before you connect your email and your books, write down what it may do unsupervised and what it may not — and remember those automatic checks burn your quota.
Walmart opens checkout to AI agents that buy for you
- On October 21 Walmart introduced Agent Gateway, an MCP-based channel letting AI assistants search and buy on Walmart.com and Sam's Club. It starts as an invitation-only beta for companies and developers, open to anyone with a Walmart account — no Walmart+ needed.
- Agent Profiles arrive within the next month: each authorized agent gets its own profile, with per-purchase approval on by default or a spending cap you set (Walmart's examples are $50, $100 and $200). Agents never receive your card details and cannot change payment methods. Amazon went the other way, cutting off Meta's Muse agent on September 20.
Why it mattersFor anyone buying from US retailers through a forwarding box or restocking a relative's pantry, this moves up the day an agent refills the list without you opening the site. If you try one, start at the lowest cap and leave per-purchase approval switched on.
The big picture
The five stories are one story: AI stopped being the topic and became the infrastructure. It found the flaw that darkened four governments' portals, it is now sold inside a rival's cloud, it writes to you first in the morning, and it is a month away from running your card at Walmart. What did not move at the same speed is our ability to verify. A judge needed eight years to put a price on one broken privacy promise, and in the meantime we are handing agents the keys to the inbox and the till. The useful question for the next few months is not which model is smartest, but what you can undo when the agent gets it wrong.
Go deeper
Sources & further reading
- Wiz Research — PHP2Shell: AI uncovers critical PHP RCE vulnerabilities
- Reuters — Government websites go dark as PHP flaw sparks security scramble
- Helsinki Times — Government websites shut down in Finland over critical flaws
- Axios — Meta ordered to pay $25 billion over Cambridge Analytica
- CNN — Meta ordered to pay $25 billion in New Mexico case
- OpenAI — OpenAI models are coming to Google Cloud
- ANI News — OpenAI partners with Google Cloud on models and Codex
- TestingCatalog — Anthropic opens Claude Duet preview for US Pro and Max users
- PPC Land — Walmart lets AI agents buy within customer-set limits
- Quartz — Walmart opens its platform to AI agents that shop for customers