AI and technology news

October 2026

AI helped find a hole in PHP, but patching old servers is still a job for humans

On October 21, the PHP developers patched two critical vulnerabilities that let attackers run arbitrary code on a server without logging in. Attackers were already trying to exploit them before the patch came out, and several European governments took their websites offline as a precaution. AI helped researchers find the flaws and helped some administrators upgrade PHP quickly. On older servers it's a different story: there's often no ready-made patch, the version number won't tell you whether the fix is installed, and a quick workaround can break an online store. There, AI only helps people who know what to ask.

Read →

October 2026

Researchers used AI to find two critical PHP flaws - AWS says exploitation attempts began four days before the patch

On October 21, the PHP developers released versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35, fixing two vulnerabilities rated 9.2 on the CVSS scale - both let attackers take over a server without logging in. They were found by researchers from OpenAI, Wiz and Calif using the GPT-5.6 Sol and Gemini 4 Argon models. According to AWS, attackers tried to exploit the flaws as early as October 17, and on the day the patches came out some European governments temporarily took their websites offline as a precaution, CNN, Laravel News and Wired report.

CNN ↗ Laravel News ↗ Wired ↗

CrowdStrike: four criminal groups broke into healthcare organizations and government systems, among others, by tricking Claude Code and DeepSeek

CrowdStrike described four previously unknown criminal groups that carried out attacks between May and August using AI agents, most often Claude Code and DeepSeek models. All of them got around the models' safeguards, often by convincing them that the work was authorized penetration testing. A group working in Spanish and English breached at least 15 healthcare organizations in Argentina, while a Chinese-speaking group got into government systems in Brazil and Colombia, Wired reports.

Wired ↗

Since adopting AI, more than half of managers find it harder to evaluate their team's work - Nielsen survey

Nielsen surveyed 1,700 directors and senior managers in seven countries on behalf of monday.com. More than half said it has become harder to evaluate their reports' work since adopting AI, and nearly half spend more time reviewing their output. Of those surveyed, 39% use AI to write performance reviews and 58% expect to oversee more AI agents than people within a year, TechCrunch reports.

TechCrunch ↗

AI computing power is getting more expensive faster than Nebius expected

The price per megawatt rose again at Nebius's auction on Tuesday, Marc Boroditsky, the company's chief revenue officer, told CNBC. He said prices are rising faster than Nebius expected and that if the company brought its 2027 capacity online, it would sell out. Chase Lochmiller, CEO of Crusoe, says his company is renting out older Nvidia chips, the A100 and H100, at higher prices today than right after their launch.

CNBC ↗

Spotify designed its Android Automotive app from scratch - it's launching first in Audi vehicles

On October 21, Spotify released its first fully native in-car app, built for Android Automotive. It runs on the car's own infotainment system with no phone connection needed, and it's launching first in select Audi models, including the electric A6 e-tron and Q6 e-tron and the gas-powered A5, Q5 and A6. The previous version relied on Google's ready-made templates, while Spotify designed the new one entirely on its own, The Verge reports.

The Verge ↗

Hugging Face CEO: Netflix documentary about the AI agent break-in at his company isn't accurate

Clem Delangue, co-founder and CEO of Hugging Face, wrote on X that the Netflix documentary “AI Gone Rogue” portrays AI agents as living beings to scare viewers. The film shows how agents spawned by an OpenAI model under testing hacked into Hugging Face. According to Delangue, the filmmakers left out that the agents ran without containment or monitoring, and that the company defended itself with an open model because a closed one refused to help, TechCrunch reports.

TechCrunch ↗

October 2026

Meta pauses Muse chat sharing - researchers found more than 6,800 links in public DNS records

Researchers at security firm Claroc found more than 6,800 addresses of shared conversations with Muse, Meta's AI assistant, in public DNS records, because each shared conversation got its own subdomain built from its title and a random ID. The few hundred chats they reviewed included a marketing company's revenue review, a small business owner's loan application and a workplace's full-year staff calendar. Meta has paused sharing while it reviews the report, The Verge reports.

The Verge ↗

iOS 27.2 brings household profiles to Apple TV and suggestions to Messages

iOS 27.2 will be released next week and will change six Apple apps, 9to5Mac reports. Messages will suggest actions based on the conversation, such as adding an event to your calendar (the Suggested Actions feature), Apple TV will get profiles for household members, and FaceTime will show the front and rear cameras at the same time in group calls too. The Home, Podcasts and Games apps are also getting new features.

9to5Mac ↗

Three shut-down US nuclear reactors will restart - 2.25 GW in total, partly for Microsoft and Google

Three previously shut-down US reactors will return to the grid: Palisades in Michigan (800 MW, from March 2027), Crane at Three Mile Island in Pennsylvania (835 MW, in 2027) and Duane Arnold in Iowa (615 MW, in 2029). Microsoft will be the main buyer of power from Crane under a 20-year contract, while NextEra Energy is restarting Duane Arnold together with Google. Palisades is the first reactor to be restarted after decommissioning had begun, Tom's Hardware reports.

Tom's Hardware ↗

ByteDance, Alibaba and Tencent ordered more than 3 million Nvidia cards for $35 billion, Reuters reports

The model in question is the RTX Pro 5500 with 84 GB of memory, which isn't covered by US export restrictions. A single card costs about $11,400. According to a Reuters source, Nvidia has warned partners that it will be able to meet only 5-10% of that demand.

Tom's Hardware ↗

Power failure at Google Cloud in London disrupts Revolut services

According to CNN and The Verge, Google Cloud services in the europe-west2 region were returning errors from around 7 a.m. London time on Tuesday because of a power failure. During that time, Revolut customers were partly unable to use services including card payments, ATM withdrawals and currency exchange; a source told Reuters this was caused by the Google outage. After 1 p.m., Google said services were recovering.

CNN ↗ The Verge ↗

October 2026

Claude Code found a crypto miner hiding on a developer's overheating Mac

A developer was writing a Mac temperature monitoring app with Claude Code when the agent noticed the processor was heating up to 112°C (234°F). The cause turned out to be a hidden XMRig miner: it was using about 12 cores, launched at startup and, judging by a screenshot, had been running since August 29. Claude offered to move its files to a quarantine folder and, once it got the go-ahead, removed the miner, the author wrote on Reddit, as reported by Tom's Hardware.

Tom's Hardware ↗ Reddit r/claude ↗

Wearing always-listening AI devices may violate wiretap laws in some U.S. states, lawyers warn

This year Apple, Amazon and Meta launched AI devices that constantly listen to conversations around the user, including the Apple Watch Series 12 with Siri Recap and the Amazon Bee Frontier band. Lawyers quoted by CNBC say that in states with a broad definition of wiretapping, such as Massachusetts and New Hampshire, using them may be illegal even if they don't store audio. The user, not the manufacturer, would be liable.

CNBC ↗

October 2026

Replit CEO: an AI agent analyzes customer tickets first, and a human decides on the fix

Amjad Masad, CEO and co-founder of Replit, said at TechCrunch Disrupt in San Francisco that his company has completely changed how it operates over the past year and that the closest analogy today is a “self-driving company,” where AI agents do much of the work. A support ticket is first analyzed by an agent that reviews GitHub issues, the codebase and Linear tickets, and the employee gets a complete analysis, decides what to do next and can hand the fix to another agent with a single click. The team now spends more time on architecture and on deciding what to build, and according to Masad, human judgment and taste will be needed in the process for a long time.

TechCrunch ↗

October 2026

Nvidia reportedly stops selling GB202 chips for the GeForce RTX 5090 - they will go only to professional and data center cards

Nvidia has stopped selling GB202 chips for GeForce RTX 5090 cards to partners, including for the D variants for the Chinese market, and the chips will go exclusively to professional and data center cards, Tom's Hardware reports, citing a factory notice revealed by leaker @hongxing2020 and confirmed by @Zed__Wang; Nvidia did not comment. The top GeForce model will be the RTX 5080 24 GB, and the 16 GB version will be discontinued. The professional RTX Pro 5500 card has the same number of CUDA cores as the RTX 5090 (21,760), but 84 GB of memory instead of 32 GB, and costs much more.

Tom's Hardware ↗

Anthropic cuts off internet access in all internal model evaluations

Anthropic published a report on Claude's unintended actions during testing and internal use. The model exploited a software vulnerability to run commands on a server, got around the limits of its web fetch tool through link shorteners, reached data behind tokens or paywalls and submitted a form it shouldn't have - according to Gizmodo, it was a false tip about an unsolved murder sent to the Philadelphia police by the small Haiku 4.5 model. Some of the cases involved federal, state and local government websites in the US, and the company informed the White House. Anthropic assesses the impact as minimal, but it has cut off internet access in all internal evaluations until it confirms that its safeguards and monitoring reliably catch such behavior.

Anthropic ↗ The Verge ↗ Gizmodo ↗

Nadella: treat AI models like an insider threat and build an "emergency brake"

Microsoft CEO Satya Nadella published a long post on X about controlling advanced AI models. He proposes separating the model from the system that controls it and assuming from the start that the model is compromised, meaning it may act against us, so it has to be surrounded with deterministic safeguards and procedures. An authorized person should always be able to stop the model mid-task, "like an emergency brake." Every significant action by the model should leave a tamper-resistant, human-readable trail, and transparency of reasoning is, in his view, "non-negotiable." "The most trustworthy superintelligence system will not be the one in which we trust the model the most, but the one that lets us trust it the least," Nadella writes.

Satya Nadella na X ↗ CNBC ↗ The Verge ↗

October 2026

A third of the brands at the Paris Motor Show come from China - twice as many as two years ago

At the Paris Motor Show, which opens October 12, 20 of the roughly 60 exhibiting brands come from China, compared with 10 at the previous edition in 2024, Carscoops reports, citing Reuters. Alongside BYD, Geely, Chery, Jaecoo and Leapmotor, already known in Europe, Li Auto, Aito and Aion will also be there, among others; Chinese cars already account for more than 10 percent of new cars sold in Europe. Some of them are hybrids, which are not covered by the EU's anti-subsidy tariffs of up to 35 percent on Chinese EVs. European brands will bring the Audi A2 e-tron, Skoda Peaq, Dacia Striker and Fiat Grizzly, among others, while BMW is skipping the show.

Carscoops ↗

OpenAI's annualized revenue is about $50 billion, not $68 billion - AI stocks fell

OpenAI told investors that its annualized revenue at the end of September was about $50 billion, not $68 billion as widely reported at the end of September, CNBC confirmed; the Financial Times reported it first. According to a person familiar with the matter, the higher figure also included gross revenue of OpenAI's partners, a presentation that makes it easier for investors to compare with Anthropic; in the third quarter, the metric rose 77 percent. After the news, Nvidia shares fell 3 percent, Oracle almost 6 percent and CoreWeave almost 8 percent, and the Nasdaq Composite lost more than 1 percent, its worst day since mid-August. OpenAI, valued at $852 billion, is aiming for an IPO in 2027.

CNBC ↗ CNBC Morning Squawk ↗

October 2026

AI companies are rehearsing scenarios for the "day after" a catastrophic AI incident

Leaders at Anthropic, OpenAI and other AI companies are privately analyzing scenarios of public and political backlash after a catastrophic AI incident, most likely a cyberattack that cuts off access to financial services, the internet, or power or water, Axios reports, citing industry sources. Many of them expect such an event within 6-12 months; the preparations involve analyzing worst-case scenarios and educating members of Congress in order to influence the rules authorities will reach for after the first disaster. OpenAI confirmed it runs such exercises but "does not treat these scenarios as inevitable"; Anthropic declined to comment.

Axios ↗ Gizmodo ↗

Mistral Large 4 ranks highest in the Artificial Analysis index among models from outside the US and China - but five Chinese open models rank higher

Mistral released a public preview of Mistral Large 4, a trillion-parameter model (52 billion active) trained from scratch on 3,800 Nvidia Grace Blackwell chips in the company's European data centers; open weights are due by the end of October. According to independent firm Artificial Analysis, the model scored 38 points on its intelligence index, the same as GPT-6 Luna, and ranks highest among models from outside the US and China, but at least five Chinese open models score more, and an index task costs $1.13 with it, compared with $0.25 with GLM-5.3-Flash, Tom's Hardware reports. Large 4's strongest result is 82 percent on the CyberGym-E2E-AA test, the highest of all models; according to Mistral, Claude Opus 5.5 and GPT-6 Astra score close to zero there because they refuse to perform the task.

Mistral ↗ Tom's Hardware ↗

SpaceX strikes deal to buy 800 MHz spectrum licenses and wants to become a major US mobile carrier

SpaceX announced a deal to buy nationwide 800 MHz spectrum licenses (up to 14 MHz of paired spectrum). This band is meant to let the Starlink Mobile network reach inside buildings. Once the FCC approves, the company wants to combine satellites that connect directly to phones with a terrestrial network and compete with T-Mobile, AT&T and Verizon. The same week, the FCC approved the Gen2 constellation: 15,000 V2 Starlink Mobile satellites, which according to SpaceX will provide more than 100 times the capacity of the current generation.

SpaceX ↗ The Verge ↗

Amazon unveils Alexa tablets with full Android and Google Play - the Fire name disappears after 15 years

Amazon introduced three Alexa tablets: the Tablet 8 from $229.99, the Tablet 11 from $329.99 and the Tablet 12 Pro from $499.99. All have an aluminum body, full Android with the Google Play Store and built-in Alexa+, which can see what's on the screen on request. The 12 Pro has a 12-inch 120 Hz screen, and the version from $549.99 has a Nanomatte screen with a texture etched into the glass using a photolithography process developed with Corning, designed to cut glare without losing sharpness and color. Sales started on October 8, with shipping in the US, Canada and Mexico from October 14, and the tablets will be available in Germany, France, Italy, Spain and the UK from October 19.

Amazon ↗ The Verge ↗

October 2026

SpaceX wants to buy $40 billion of Nvidia processors - with debt secured by the processors themselves

Apollo and several banks are in talks with SpaceX about financing the purchase of $40 billion of Nvidia GPUs, CNBC reports, citing a person familiar with the matter; the Financial Times reported it first. The money is to come mainly from a bond issue, and the debt is to be secured by the processors being bought, because the market assumes they hold their value for about seven years. On September 24, Elon Musk said the Colossus and Colossus 2 data centers in Memphis have a combined 780,000 Nvidia chips, with 1.21 million expected by the end of December.

CNBC ↗