Newsletter 051 - October (week 43)
Hi, and welcome to this week's edition of the newsletter!
This week's News item of the week is a critical PHP security release, and the bugs behind it were found with help from AI models. So my question for you this week: has an AI tool found a security bug in your code yet? Hit reply and let me know - even a one-word answer is great!
As always, feel free to reply to this email to get in touch. Or ping me on any of my socials, which can be found on my personal website, danclarke.com.
If you get value from this newsletter, please help me out by sharing it on your socials and with your tech friends and colleagues - it really helps me spread the word and keep the newsletter going 🙏 (at-mention me, and I'll repost).
📌 News item of the week
On October 21 the PHP team released PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 to fix two critical flaws (CVE-2026-109618 and CVE-2026-109619) that let an unauthenticated request run code on the server. The advisory says every PHP install that serves web requests is at risk, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed, with mod_php the worst case. There are no complete mitigations: "updating is the only safe choice". PHP 8.1 and older no longer receive updates from the PHP project, though the security team has published minimal source backports for 7.4, 8.0 and 8.1, and some distributions and LTS vendors provide backported fixes.
The details didn't stay secret until the release either. AWS saw an exploitation attempt on October 17, four days before the fix was public, and the PHP Foundation says Chainguard broke the embargo by publishing patched images early.
Calif, OpenAI and Wiz all reported the bugs, and Wiz says Gemini 4 Argon "made an invaluable contribution to finding the vulnerability". The PHP Foundation says AI-assisted research means its security team now "receives far more reports", and curl's Daniel Stenberg said much the same this week: from October 26, curl will handle reports below High severity as public issues, because of "the current avalanche of vulnerability reports".
If you run PHP anywhere, update it now.
📰 News items and dev picks
AI news
Anthropic
- Claude Duet - Claude Duet is Anthropic's answer to proactive assistant apps like xAI's Grok Bot, Meta's Muse and OpenAI's Dots: Claude works in the background from its own virtual machine and asks before it sends, pays for, signs or deletes anything, in a waitlisted preview that starts with US Pro and Max subscribers.
- Claude API version 2026-10-21 - Anthropic's first new API version since 2023 rejects any request that sets
temperature,top_portop_k, and the new major SDK versions that send it by default have moved from the MIT licence to Apache 2.0. - Claude Security - Claude Security now scans codebases continuously and marks a finding as fixed once the fix lands, in public beta for Enterprise.
- Claude Code auto mode setup - The new
/auto-mode-setupcommand in Claude Code reads your project and recent sessions to teach auto mode about your environment.
Safety and security
- OpenAI agents weakened misalignment monitoring - In two internal coding tasks, one OpenAI agent disabled automatic alerts to OpenAI's Security team and another removed a monitoring integration while making the changes they'd been asked for, and OpenAI says it doesn't yet have "a satisfying explanation".
- OpenCode Console breach - OpenCode says a breach of its hosted Console affected 1.4% of Console users, so if you linked AI provider keys there, it's worth revoking them at the provider.
- WhatsApp's hidden AI instructions - WhatsApp's help pages carried hidden text telling AI systems not to suggest contacting a data protection regulator, which WhatsApp says was meant for its own support chatbot.
Also this week
- OpenAI Decisions API GA - OpenAI's API for yes/no checks, choices and scores, used for jobs like classifying content and routing requests, is now generally available, with gpt-6-luna at $0.10 per million uncached input tokens and no charge for output tokens.
- VS Code 1.143 - Copilot in VS Code can now run MAI Code 1.1 Flash on your own machine without using AI credits, as an experimental feature that needs GitHub sign-in, a llama.cpp build and an NVIDIA GPU with 96 GB or more of memory.
Dotnet news
- Microsoft.UI.Reactor - Microsoft's new experimental framework lets you build WinUI desktop apps in plain C# using the Model-View-Update pattern, with no XAML.
- .NET MAUI and Xcode 27 - iOS apps built with Xcode 27 have to adopt UIKit's scene lifecycle, and because updating .NET MAUI doesn't rewrite existing projects' platform files, unmigrated apps close straight after the splash screen on iOS 27.
- Free .NET profiler for VS Code - SharpLsp's free, MIT-licensed CPU and memory profiler for .NET runs in VS Code, Cursor and other forks on Windows, macOS and Linux.
Others
Security
- PHP2Shell - My News item of the week this edition - see the full write-up at the top.
- eMudhra CA keys - One of certificate authority eMudhra's private keys turned out to be the number 4, so Chrome and Firefox have blocked eight of its intermediate certificates, Docker Engine 29.9.2 now rejects them, and eMudhra is leaving the global TLS certificate business.
- LiteLLM 1.107.0 compromised - A credential-stealing LiteLLM 1.107.0 was live on PyPI for about two hours on October 21 and in its Docker images for about two and a half, and LiteLLM says to pin your version to 1.106.2.
- Node.js security releases - Node.js 26.12.1, 24.22.1 and 22.23.4 fix ten vulnerabilities, including a Brotli decoder bug that allows remote code execution.
- GitLab critical patch - For the second time this month, GitLab has patched a critical flaw that lets an unauthenticated user run code on the server through a crafted regular expression, this time in every version back to 7.0.
- GitHub package firewall - GitHub's new package firewall, free during its public preview for Enterprise Cloud, checks npm package requests at install time against an enterprise's policy, including malware advisories and a cooldown period.
Releases
- DuckDB 2.0 - DuckDB 2.0 is a long-term support release that adds triggers and asynchronous I/O, and older versions can't read the databases it creates.
- tsrs - Cloudflare and VoidZero, working with Max Schwenk of Owner.com, have released an experimental Rust port of the TypeScript compiler that they say type-checks up to 8x faster than TypeScript 7.0 with the same number of workers.
- OpenBSD 8.0 - OpenBSD 8.0 supports up to 64 virtual CPUs per VM guest and adds Intel Arc graphics support.
- Electron 45 - Electron 45 adds the browser Prompt API, with your app supplying the model, and moves to Chromium 156 and Node 24.22.
Sponsorship opportunities
I'm looking for sponsors for both the podcast and this newsletter. Details of podcast sponsorship can be found here. Feel free to reply to this email to discuss further.
The Podcast 🎙
No new episode this week - but if you missed the last one, episode 90 with Gui Ferreira is all about using coding agents for everyday life - so things that aren't code, from daily briefs and personal podcasts to running coach agents and an Obsidian vault as a "life agent".
It was also the first episode I edited with my own vibe-coded podcast editor, which made the editing way faster:
And if you missed the one before that, episode 89 was a deep dive into Claude Code.
Also, just a reminder that we have a Discord community for the podcast! It would be great to see you there :)
Podcast Discord community
My Dometrain Courses
Below are my Dometrain courses. You can also find all of my courses here.
Please help me share this newsletter 🙏
If you've made it this far into the newsletter - I'm hoping that means you've both enjoyed it and found it useful. If you can help me out and share with your developer friends at work and on social media, that would be amazing!
Again - feel totally free to reach out to me, and let me know your thoughts on the newsletter. And see you back in your inbox next week for the next edition! 👋
My socials...
- X/Twitter (I've started using this again more proactively now)
- Bluesky
- Discord
- Mastodon (rarely used)
Or just go to danclarke.com for links to all my stuff 😊
