GenAI Daily - October 22, 2026: AI-Found PHP Flaws Force Emergency Patches, Anthropic Ships Claude Duet, Meta Lifts AI Spend Floor
Top Stories
AI-Found PHP2Shell Flaws Force Emergency Patches Across the Web
PHP fixed two critical flaws, CVE-2026-109618 and CVE-2026-109619, both rated 9.2 on CVSS v4.0. Either can allow unauthenticated remote code execution.
The fixed releases are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, published October 21.
The fix was due on October 22, but disclosure was pulled forward after details leaked online on October 20.
Security firm Calif found the flaw using OpenAI's GPT-5.6 Sol. Google-owned Wiz independently discovered and reported it, according to OpenAI's blog post.
Wiz used Wiz Atlas, Gemini 4 Argon, and GPT-5.6 Sol, with Argon making a particularly significant contribution.
The bugs sit below the application layer.
Both paths are reachable before any application code runs, so a fully patched WordPress or Laravel site is still exposed if the underlying PHP is not.
Wiz says every PHP version released in the last decade is affected by at least one of the bugs, going back to PHP 5.4. Those older branches get no fix from PHP itself, so teams need a distributor backport or an upgrade.
The flaws can also expose process memory, including passwords, API keys and tokens.
OpenAI also published a five-stage framework for coordinating disclosure of AI-found vulnerabilities, along with a PHP version checker packaged for Codex. It restated a $1 billion discounted-access commitment for its security AI aimed at organizations with small security teams (PPC Land).
Fortune | Wiz Research | CyberScoop
Why it matters: Inventory every PHP runtime, including container base images and vendor-managed hosts, and patch now. Wiz also notes that in the era of AI hacking, the difficulty of building exploits for complex memory bugs "is no longer a barrier."
Anthropic Opens Claude Duet, a Proactive Opus 5.5 Agent
Anthropic introduced Claude Duet on Wednesday, a standalone agent app built to work in the background and flag what needs attention without waiting to be asked.
It is available on iOS, Android and claude.ai as a research preview with a waitlist, initially for US Pro and Max subscribers.
Team and Enterprise plans are not included yet.
It sends a short brief each morning on important items from connected apps, then checks apps every few hours and alerts when something needs attention.
Architecturally, Duet runs on Claude Opus 5.5 inside its own virtual machine with a browser, so it keeps working when the user's laptop or phone is off.
It plugs into more than 6,000 connectors in the Claude Marketplace, including Gmail and Slack.
The agent asks permission before sending a message, making a payment, signing a document, or deleting anything.
MacRumors frames it as Anthropic's answer to Meta's Muse agent and OpenAI's Dots agent.
Why it matters: The approval-gate pattern (agent works unattended, human signs off on sends, payments and deletions) is becoming the default for proactive agents. Teams building their own should check how their approval design compares, and watch for an Enterprise tier that brings admin controls.
Meta Raises AI Capex Floor to $135B and Creates Non-Voting Class C Stock
Meta now expects 2026 capital spending between $135 billion and $145 billion, up from a previous range of $130 billion to $145 billion.
Third-quarter revenue came in at $64.60 billion, ahead of the $63.37 billion Wall Street expected.
The money goes toward AI infrastructure and also funds development of Muse, Meta's consumer AI agent.
The bigger structural change is on the financing side.
Meta plans a new class of publicly listed Class C common stock with no voting rights, effective January 19, 2027.
Existing Class A and B holders get a one-time dividend of one Class C share per share held.
The filing says the shares are meant for capital raising, employee compensation, and potential acquisitions.
Meta ended the quarter with 66,775 employees, 15% fewer than a year earlier, while spending on data centers and equipment rose 80%.
CryptoBriefing | Meta 8-K | StockTitan
Why it matters: Meta is signaling that frontier compute is now a capital-markets problem, not just a budget line. Teams relying on Muse or Meta's open-weight releases are tied to a company committing heavily to compute, but with a tighter cash cushion.
Key Developments
Snowflake Puts Horizon Context in Public Preview; Databricks Widens CustomerLake Beta
Snowflake said on October 20 that Horizon Context metadata connectors for 18 sources, steward permissions and description propagation are in public preview, so AI agents and BI tools can reuse shared business context.
Horizon Context is a governed context layer inside Horizon Catalog that collects metadata and enriches it with business meaning.
The pitch is that an agent answering a question like "why did retention decline" needs the right metric definitions, not just fluent prose.
Databricks is moving on the application side of the same problem.
On October 19 it opened CustomerLake Campaign Agents, which build audiences and run campaigns, to Beta customers that meet its technical requirements, and put Profile Agents, which builds Customer 360 profiles, into private preview.
General availability and pricing remain unannounced.
Together the two moves show both vendors trying to own the context and execution layers that CRM and marketing-cloud vendors have treated as theirs.
Impact: Data-platform vendors are pushing into agent context and campaign execution. Buyers evaluating Salesforce or Adobe stacks should ask what a warehouse-native alternative would cover, and note that pricing and GA dates for CustomerLake are still unknown.
Wall Street Banks Struggle to Budget for Agentic AI Costs
Hopes for productivity gains are pinned on agentic AI, but it is inherently hard to budget for because the compute each task consumes can be unpredictable.
Global banks are wrestling with surging AI bills as executives deploy the technology across workflows. After one-too-many surprise bills, controlling costs has become an imperative.
The issue is simmering in banks, where technology budgets already face pressure from legacy IT modernization and cybersecurity.
This matches pricing signals elsewhere. Anthropic's Duet is bundled into existing Pro and Max allowances, and Google is pricing Gemini 4 Argon at a limited-time half the per-token cost of Claude Opus 5.5 and one-fifth that of GPT-6 Astra.
Per-task variance, not list price, is what finance teams are now struggling with.
Impact: Expect more demand for per-agent spend caps, token budgets and cost attribution in gateways. Teams without them should add these before scaling agent deployments.
ChatGPT Ads Expand to 26 More Countries, Total Reaches 89
OpenAI extended advertising in ChatGPT to 26 more countries, taking the number of markets where ads are sold to 89. It said more than 100,000 advertisers have run campaigns since launch just over eight months ago.
The ads appear to users of the free and cheapest paid tiers.
OpenAI published no revenue figure with the announcement.
PPC Land cites an earlier Digiday report that ChatGPT ads passed a $1 billion annualized run rate.
Impact: Ad revenue may subsidize cheaper consumer tiers, which affects how aggressively OpenAI prices its API and enterprise products. Marketing and e-commerce teams should treat ChatGPT as a measurable paid channel.
Product Launches
Trail of Bits patching-bugs and regression-hunt Agent Plugins
Two plugins let engineers delegate patch development and regression checks to agents. Patching-bugs reproduces reported bugs, develops fixes and tests them. Regression-hunt checks whether changes break previously working behavior.
A review of over 130 merged patches confirmed 21 regressions.
In preliminary evaluations, regression-hunt produced 25% fewer false-positive findings than a baseline Codex agent prompted to review the PR for regressions.
Patching-bugs requires a "three-arm proof" (original fails, patch passes, reverting the patch fails again) and reads project-supplied THREAT_MODEL.md and PATCHING_GUIDELINES.md files.
Teams using AI-generated patches get a verification workflow they can drop into Claude Code or Codex.
Why it matters: AI-generated patches can introduce new regressions while fixing the reported bug. A verification workflow like this gives teams a repeatable way to check what else a patch changed before it ships.
Funding & Deals
Legora Raises $550M Series E
Stockholm-founded legal AI company valued at $8.8 billion post-money, building an agentic operating system for lawyers that covers document review, legal research and contract drafting.
It serves more than 140,000 legal professionals at over 2,400 law firms and in-house teams.
Annual recurring revenue now exceeds $200 million, up from $100 million in April.
In-house legal teams made up more than 40% of new customers in the third quarter.
Led by Atreides Management.
Pigment Raises $250M Series E
Paris-based AI business planning platform valued at $2.3 billion, with agents running on its Graphite compute engine.
Graphite lets thousands of AI agents and people work on the same governed model at once, scaling to hundreds of billions of data points with deterministic, traceable results.
Customers include Danone, DirecTV, Siemens, Snowflake, ServiceNow, Unilever, Anthropic and Uber.
The company plans to extend agents from building models to running planning workflows end to end. Led by Scaleup Europe Fund, managed by EQT.
Town Raises $108M Series B
San Francisco-based maker of an AI work assistant that extends from individual users to whole teams, now valued at $1 billion.
Existing investors a16z and First Round Capital also participated. Co-led by Forerunner Ventures and Menlo Ventures.
The round adds to the steady flow of late-stage funding for AI products aimed at everyday workplace tasks, with the new valuation reaching the $1 billion mark.
Tomorrow's Watch List
- NVIDIA GTC Berlin wraps up. The event runs October 20-22 and includes new European startup investments and local-agent hardware announcements.
- PHP2Shell follow-up: expect scanning and exploitation reports, and distributor backports for end-of-life PHP branches.
- Claude Duet waitlist rollout: watch for any Team or Enterprise timeline.
Related reading: Check out this week's [Deep Insights analysis] for strategic context on these developments.
GenAI Daily is curated by rAInvent. For in-depth analysis, see the rAInvent articles.
