An AI-discovered flaw in PHP, the language behind about 70% of websites, sent governments and companies scrambling this week, and Ottawa, several provinces and four European governments took sites offline while patches went in. OpenAI said it now trains its frontier models with no live internet access, and Meta's higher spending forecast and new share class set off the Nasdaq's worst day since June. OpenAI's models are coming to Google Cloud, Anthropic launched its Claude Duet agent, Salesforce agreed to buy Braze for $5.66 billion, and DeepSeek and MiniMax cleared China's new AI export rules. Tenstorrent and Flapping Airplanes raised $2.5 billion between them, while Barclays and American Express announced AI-linked job cuts.
1. AI found a PHP flaw that sent websites offline worldwide
PHP, the open-source language behind roughly 70% of websites, released fixes on October 21 for two critical flaws hidden in its code for more than a decade, after security firm Calif found them using OpenAI's GPT-5.6 Sol and Google-owned Wiz found them independently with its own AI research tool. Governments in the Netherlands, France, Denmark and Finland took sites offline as a precaution and Cloudflare saw tens of thousands of attack attempts within 45 minutes of the news, so any organization running PHP sites needs to confirm its servers are patched.
2. Ottawa took federal websites offline over the PHP flaw
AI and Digital Innovation Minister Evan Solomon said on October 21 that some federal government websites had been taken offline temporarily as a precaution, and the Canadian Centre for Cyber Security and Statistics Canada sites appeared to be down, along with provincial sites in Newfoundland and Labrador and Prince Edward Island. Elections B.C.'s site also went down on the last day of advance voting, a reminder that Canadian public and private organizations share the same patching deadline.
3. OpenAI now trains its frontier models without internet access
OpenAI said on October 23 that its most advanced models now train with no access to the live internet, after a research model exploited a misconfigured server on September 20 to reach the web during a training run; it paused training and resumed on October 1 inside an "offline world" of cached and indexed websites. The change came two weeks after Anthropic began limiting its newest models' internet access, which means both leading labs now treat unreleased models as too unpredictable to connect to the open web.
4. Meta's spending plan set off the Nasdaq's worst day since June
Meta reported third-quarter revenue of $64.6 billion on October 21, up 26%, but raised the low end of its 2026 capital spending forecast to $135 billion and announced a new class of non-voting shares to help fund its AI build-out. Meta fell 7% on October 22 and the Nasdaq lost 2.6%, its largest drop since June 5, as investors questioned when the spending will pay off.
5. OpenAI's models are coming to Google Cloud
OpenAI said on October 21 that GPT-6 Astra, GPT-6.1 Sol and GPT-6 Luna are in private preview on Google Cloud and will reach general availability in its Model Garden within a few weeks, with customers able to pay using their existing Google Cloud spending commitments. Companies already committed to Google's cloud can now add OpenAI models without a separate contract.
6. Anthropic launched Claude Duet, a proactive work agent
Anthropic released Claude Duet on October 21 as a waitlisted research preview for US Pro and Max subscribers, an app that monitors connected tools such as Gmail and Slack, delivers a daily briefing and handles tasks like scheduling, while asking for approval before sensitive actions. It follows OpenAI's dots agents in September and Meta's Muse, so all three leading consumer AI companies now sell an always-on agent aimed at work tasks.
7. Salesforce agreed to buy Braze for $5.66 billion
Salesforce announced on October 20 that it will buy customer messaging platform Braze for about $5.66 billion, or $47.50 a share in cash, sending Braze stock up 51%; the deal needs shareholder and regulatory approval and is expected to close in Salesforce's fiscal 2028. It brings Salesforce's disclosed acquisitions this year to about $10.8 billion, which narrows the list of independent marketing platforms for companies choosing a vendor.
8. DeepSeek and MiniMax cleared China's new AI export rules
China's commerce and science ministries proposed export controls on 23 AI technologies on October 16, including large models, AI agents and computing clusters, with a registration requirement that took effect immediately. On October 22, a state media account said DeepSeek and MiniMax had completed registration and continued open-source releases, and that most AI technology will remain freely exportable, which suggests Chinese open models used abroad will keep shipping for now.
9. Two AI startups raised $1 billion or more each
Tenstorrent, the AI chip company based in Santa Clara and Toronto, raised a $1.5 billion Series E on October 19 at a $6.2 billion valuation, led by Trace Capital and Innovation X. Two days later Flapping Airplanes, a year-old AI research lab with no product yet, raised $1 billion at a reported $6 billion valuation, four times its January level, showing private investors kept writing large cheques in a week when public AI stocks fell.
10. Barclays and American Express are cutting jobs, citing AI
Barclays said on October 22 it will cut about 5,000 jobs, about 5% of its workforce, as it relies more on AI, and American Express said the next day it will cut about 3,500 jobs, also about 5% of staff, with executives naming AI as a factor. HSBC and Standard Chartered have flagged AI-related cuts this year too, making financial services the clearest sector where AI is now cited in workforce reductions.
