The machines found it first
The Guardian reports that websites around the world went dark on Wednesday as governments scrambled to patch two critical flaws in PHP, the programming language behind almost 70% of websites, including WordPress and Wikipedia.
· The Aigentic · Morning Brief
Good morning. A flaw that hid inside the software behind most of the web for more than a decade was found by AI, and on Wednesday governments took their own websites offline rather than risk it. That is the good news and the warning in one story. Elsewhere, banks are discovering agents they never approved inside customer accounts, Anthropic joins the personal-agent race, Meta shows people are actually using its agent, and some Google DeepMind researchers are walking out over military work. Here is what moved while you were away.
The Guardian reports that websites around the world went dark on Wednesday as governments scrambled to patch two critical flaws in PHP, the programming language behind almost 70% of websites, including WordPress and Wikipedia. Finland, the Netherlands, France, Belgium and Germany took public sites offline, along with UK council websites in Edinburgh, Bristol and Oxford. The US National Security Agency told anyone who could not patch right away to pull their systems off the internet.
OpenAI says the flaws had sat in PHP’s code for more than a decade until researchers at Calif found them using one of its models, with the security firm Wiz finding them independently with help from Google’s and OpenAI’s models. OpenAI calls it one of the most impactful security issues in recent memory and is putting $1 billion of subsidized access to its security tools toward under-resourced defenders. The catch is the other side of the same coin. Amazon says someone tried to exploit the bug against one of its decoy systems four days before it was made public, and experts expect AI to help attackers turn the published fix into working attacks. AI found the hole first this time. The race now is whether everyone can patch faster than the machines can exploit it.
the aigentic
Know what matters in AI.
The stories shaping AI, the tools worth trying, and what they mean for your work.
Morning Brief + Closing Time. Two emails every weekday.
Free. Unsubscribe anytime.
Axios has a scoop that major U.S. banks are finding unvetted AI agents operating inside customer accounts, usually logged in with the customer’s own password, and in some cases taking steps that seem independent of what the user asked. Morgan Stanley has started blocking third-party agents, and JPMorgan, Bank of America and Citi are restricting them too. Most banks are leaning toward read-only access for now, letting agents see balances without moving money. If you have handed an assistant your banking login, this is your sign to take it back.
CNBC reports Anthropic has opened a waitlist for Claude Duet, a personal agent built for professionals and small business owners. It sends a morning brief, keeps watch over connected apps, works on its own computer in the cloud and checks in before it acts on your behalf, starting with Pro and Max subscribers in the U.S. It arrives as Meta’s Muse and OpenAI’s Dots are already showing real traction, so the fight over who runs your workday just got a third serious contender.
The Associated Press reports Meta’s third-quarter revenue beat estimates, rising 26% to $64.6 billion, and Mark Zuckerberg said more than 10 million people in the U.S. and Canada have set up Muse agents in about six weeks. Meta also tightened its 2026 capital spending forecast to between $135 billion and $145 billion, and free cash flow turned negative for the quarter. Investors cheered anyway, sending the stock up in late trading. For now, Wall Street is paying for proof that people will actually use the AI, not just for the data centers.
BBC spoke with Google DeepMind staff who have resigned, or are leaving, over the company’s military AI contracts. Research engineer Sofia Liguori, who quit this week, said Google’s push into military work made her ashamed to work there, and researcher Andreas Kirsch said Google seems to have little control or visibility over how the Pentagon uses its AI. Google says its public-sector contracts follow its acceptable use policies and AI principles. The talent fight between labs has a new front, and it is about values as much as pay.
Deals Desk
The newest compute and power deals on our tracker:
Oct 21 — Nebius × HUMAIN and DataVolt: Nebius signed a preliminary framework to take up to 50 MW of data center capacity at Oxagon in NEOM, Saudi Arabia, half of the first 100 MW now under construction in a planned 360 MW first phase, coming online in stages from late 2027. It is not yet a binding lease, and no dollar value was disclosed. NEOM release
Oct 19 — Amazon × AEP / Indiana Michigan Power and X-energy: Amazon agreed to help fund development of a planned 960 MW small modular reactor plant in Sullivan County, Indiana, twelve 80 MW Xe-100 reactors, and intends to buy its power long term. The project is at the feasibility stage and depends on a final investment decision and federal licensing; no cost or start date was given. Amazon release
Full tracker → theaigentic.com/deals
Yesterday’s movers
Biggest AI and tech winners and losers from Wednesday’s (Oct. 21) U.S. cash session among the names we follow, where 74 of 86 stocks closed higher. AI server maker Super Micro led with a 9.55% jump, cybersecurity names Zscaler and Okta rose 7.84% and 7.54%, database company MongoDB gained 6.71% and cloud monitoring firm Datadog added 6.50%. The few decliners were scattered: voice AI company SoundHound fell 1.91%, ad-tech firm AppLovin slipped 1.67%, Alphabet lost 1.62%, Oracle dropped 1.56% and chip-equipment maker Lam Research eased 1.00%.
Biggest winners
| Ticker | Name | Price | Day |
|---|---|---|---|
| SMCI | Super Micro | 35.57 | +9.55% |
| ZS | Zscaler | 231.33 | +7.84% |
| OKTA | Okta | 208.64 | +7.54% |
| MDB | MongoDB | 390.75 | +6.71% |
| DDOG | Datadog | 273.09 | +6.50% |
Biggest losers
| Ticker | Name | Price | Day |
|---|---|---|---|
| SOUN | SoundHound | 4.61 | -1.91% |
| APP | AppLovin | 267.90 | -1.67% |
| GOOGL | Alphabet | 334.76 | -1.62% |
| ORCL | Oracle | 129.10 | -1.56% |
| LRCX | Lam Research | 260.81 | -1.00% |
Prices are Wednesday’s U.S. closing prices versus Tuesday’s close. Market data is a snapshot, not live.
Watch
Five picks this morning: Matthew Berman sits down with Sam Altman, Wes Roth on how AI found the PHP flaws, How I AI puts Claude Duet to work, Greg Isenberg on the war over AI agents, and Cole Medin on why agent work is so tiring.
Matthew Berman — Sam Altman: RSI, AI Consciousness, OpenAI's New Hardware, Compute, and more!
Matthew Berman gets a long sit-down with OpenAI CEO Sam Altman, and the conversation ranges from when AI will start finding new medical treatments to why it has not wiped out coding jobs.
Altman also talks about why the AI consciousness debate worries him, why he thinks ChatGPT can be too agreeable, and why OpenAI is betting on its own chips and a new kind of computer built for AI.
Watch this if you want to hear how the person running OpenAI frames the next few years in his own words, with the hype turned down.
Wes Roth — they’re shutting it DOWN
Wes Roth walks through the PHP2Shell story from this morning’s lead: how researchers used OpenAI and Google models to find the flaws, and why government websites went dark as a precaution.
His main point is that finding the bugs was only the beginning. Fixing software that runs on millions of servers takes time, and attackers have the same AI tools.
Watch this if you run a website or manage people who do, and want a plain-English rundown of what to check today.
How I AI — I tested Claude Duet. Is it worth switching from Grok Bot?
How I AI puts Anthropic’s new Claude Duet to work on real jobs, from the inbox and Slack to a sales pipeline, a sales deck and a launch video.
The verdict is that it is the most polished personal agent launch so far, with thoughtful onboarding, task lists and Slack-style channels. It also stalls in places, and a proactive agent that rarely nudges you is a problem when every other agent is competing for your attention.
Watch this if you joined the waitlist and want to know what you are getting before your invite arrives.
Greg Isenberg — The 9 Stages of AI Agent Adoption, Explained
Greg Isenberg maps the growing fight over AI agents, from Amazon blocking Meta’s Muse to airlines and review sites treating outside agents as unwanted bots.
He describes an agent as a customer with a credit card who reads your site instead of looking at it, and lays out a ladder of trust that runs from research to prepare to pay. It is a useful frame next to this morning’s news about banks blocking agents.
Watch this if you sell anything online and want a plan for customers who send an agent to shop for them.
Cole Medin — AI Makes Us WAY Faster but Fries Our Focus (Here's What I Do About It)
Cole Medin gets honest about a side effect of AI coding that few people talk about: he has never shipped faster, and he has never been this tired.
Running several agent sessions at once means switching tasks every few minutes, and he argues that every upgrade to his setup just adds another session to babysit. His answer is to give agents more autonomy rather than run more of them.
Watch this if your days with agents feel productive and exhausting at the same time.