An AI-found flaw forces an emergency patch across the web as frontier AI's economics go on the record.

The maintainers of PHP, the programming language behind an estimated 70% of the world's websites, released emergency fixes on 21 October for two critical remote code execution vulnerabilities, Investing.com reported. Known together as PHP2Shell (CVE-2026-109618 and CVE-2026-109619), the flaws carry a CVSS v4.0 rating of 9.2 and affect every web server running PHP 5.4 or later. Fixes shipped in four releases at once – 8.5.12, 8.4.27, 8.3.36, and 8.2.35 – while PHP 8.1 and earlier get no official fix. The report singles out shared-hosting setups running WordPress, Drupal, Joomla, or Magento as particularly exposed.

AI sits at the center of the story on both sides. OpenAI said its GPT-5.6 Sol model found CVE-2026-109618 in August through its Patch the Planet initiative, and Wiz Research separately discovered and reported both flaws. The coordinated release did not hold to plan: details leaked publicly on 20 October, and Cloudflare recorded the first attacks on PHP sites at 07:43 UTC on 21 October, hours before the official patch window opened at about 14:00 UTC. Reuters reported that cybersecurity agency websites in the Netherlands and Finland went dark, and agencies in Europe, Australia, Japan, and Britain told operators to update immediately or take sites offline. Cloudflare CTO Dane Knecht said the company's firewall rules for known attack routes are live for all customers, including free ones, but described them as "a STOPGAP only." Cloudflare shares were up 5.52% in Wednesday trading.

Anthropic's preliminary IPO prospectus – a draft S-1 filing – shows first-half 2026 revenue of $16.3 billion, up from $1.1 billion in the same period of 2025, according to The Wall Street Journal, which reviewed the document. The report was carried by Investing.com on 20 October. About 20% of first-half revenue came from just two customers. Over the same six months, the company spent nearly $9 billion on computing capacity and infrastructure, more than its $7.3 billion total for all of 2025.

The filing puts the scale of frontier AI's cost base in writing. Anthropic has about $450 billion in cloud compute agreements over the next decade, including $111 billion with Google Cloud, $110 billion with Amazon Web Services, and $31 billion with Microsoft, and indicated it could spend up to $750 billion on compute in coming years, counting deals still under negotiation. It says it has sought more capacity than the hyperscalers were willing to supply and is pursuing third-party data center developments. The first-half net loss was $80.7 billion, but about $72 billion of that stems from non-cash accounting adjustments tied to convertible notes and other financing instruments. Risk factors flag customer concentration, compute constraints, and the possibility that damages from a severe AI-related incident could exceed insurance coverage. The Journal reports the listing could value the company at about $2 trillion; no timing has been disclosed.

OpenAI and Google announced on 21 October that OpenAI's latest models, including GPT-6 Astra, and its Codex coding agent will be available through Google Cloud's Model Garden and Marketplace in the coming weeks. Customers will be able to pay for OpenAI technology out of their existing Google Cloud spending commitments, and developers will also be able to reach the models through Antigravity, Google's coding tool. Companies in regulated industries can deploy the models under Google Cloud's security controls and data governance tools.

The deal follows the April expiry of OpenAI's exclusive distribution arrangement with Microsoft, after which Amazon Web Services began offering OpenAI models. With Google Cloud added, OpenAI's models are now sold through all three major US cloud providers. OpenAI already runs ChatGPT and its API partly on Google Cloud infrastructure; this agreement adds a sales channel on top of the compute relationship. For Google, it means selling a direct rival's models alongside its own Gemini line – a bet that owning the customer's cloud budget is worth more than exclusivity for its own models. Investing.com, citing CNBC data, puts Google Cloud's annualized revenue growth at about 82% in the second quarter, against reported cloud growth of 37% at Amazon and 42% at Microsoft.

At GTC Berlin on 21 October, Nvidia launched DSX POD, a modular version of its DSX reference design for AI data centers built on its Vera Rubin platform. The units are assembled in containers, integrated and validated before delivery, and then connected to a prepared site's power, cooling, and networking. Nvidia says this cuts deployment time from six months to 14 days. Worldwide deliveries are planned for early 2027 with 17 named partners, including Dell Technologies, HPE, Lenovo, Foxconn, Schneider Electric, Vertiv, Eaton, and Crusoe.

Nvidia paired the launch with energy and water claims. It says the DSX platform can eliminate up to 100% of the water consumed by cooling, using closed-loop liquid cooling with outdoor dry coolers, which it estimates saves 54 million liters a day at 2-gigawatt scale compared with cooling towers. Its DSX MaxLPS software allocates power within a site's provisioned budget and, according to Nvidia, delivers the same token output on 30% less power. A third product, DSX Flex, lets a data center adjust workload power to utility needs, grid spikes, and energy prices. Nvidia acknowledges that some climates may still need additional mechanical cooling during extreme heat. Pricing and per-unit capacity were not disclosed.

OpenAI announced on 20 October that it has acquired Orchestra Bio, a San Francisco startup whose AI agents help pharmaceutical teams keep drug development programs on schedule. The agents monitor studies and timelines, flag problems, identify which activities and deadlines are affected, gather the relevant information, and compare response options, while scientists and program leaders make the final decisions. Financial terms were not disclosed. Orchestra, founded in fall 2022, raised a seed round of about $20 million from investors including Andreessen Horowitz, Insight Partners, and 8VC, according to Caplight data.

Orchestra's team and technology will be folded into Rosalind, OpenAI's family of life sciences models and tools. GPT-Rosalind, launched in April and restricted to vetted US enterprise customers such as Amgen and Moderna, reasons through biology and chemistry questions, and Rosalind Workbench connects it to scientific tools and data. The acquisition extends OpenAI from scientific analysis into the operational layer of drug development – the scheduling, dependencies, and decisions that determine how fast a candidate moves. It follows Anthropic's purchase of Coefficient Bio in April for a reported $400 million, and comes five days after OpenAI opened a free Rosalind plan for US university labs.

Stockholm-based Legora, which builds AI tools that law firms, professional services firms, and in-house legal teams use to draft and review documents, raised $550 million in a Series E round at an $8.8 billion post-money valuation, City AM reported on 21 October. Atreides Management led the round, joined by new investors Baron Capital, Capital Research, Fidelity Management & Research Company, and Glade Brook Capital Partners. The valuation is up from $5.6 billion in its April Series D, which brought in Nvidia's venture arm NVentures and Atlassian as corporate investors, though below the $10 billion the company was reported to be seeking in August.

Legora's annual recurring revenue grew from $1 million to $100 million in 18 months, and the next $100 million took less than six months, taking it past $200 million, according to its CFO. The company plans to use the funds to expand across North America, where it has seven offices including New York, Chicago, and Toronto, as well as in Europe and Asia-Pacific, and to invest further in Legora aOS, its agentic operating system for legal work.