martin

Most important

1. PHP2Shell / “PHP-ocalypse” dominated everything. Two critical PHP flaws were covered by Wired, TechCrunch, Dark Reading, The New Stack and Fireship. The angle that matters: AI is making old bugs much faster to find and exploit, and the PHP Foundation coordinated the fix whilst running on a shoestring budget with one full-time staff member. If you run anything PHP-based, this is the patch-first story of the period.
2. AWS issued a cluster of MCP-related security bulletins. The most relevant was CVE-2026-115845 in the AWS MCP Server run_script Python sandbox, alongside issues in AWS Multi Model Server, the Security Agent plugin's S3 ownership checks, and the awslabs MySQL/Postgres MCP servers.
3. AI attacks are getting cheaper and more autonomous. Dark Reading reported campaigns using open-weight models against 105 sites, with another case gaining full domain control for about $12: AI Tools Are Generating Massive Attacks for Little Cost. Separately, CBS reported unauthorised AI agents detected inside accounts at major banks, and Dark Reading covered Microsoft's “Guardian Agents” idea for policing other AI agents.
4. AI economics backlash grew louder. Apollo's Torsten Sløk argued there has been no financial payoff to AI outside tech, with AI now viewed by many firms as a margin-hurting cost centre; the same piece topped Hacker News. TechCrunch also maintained its “AI graveyard” list, and Techmeme carried the NYT look at Alpha School, where roughly half of K–8 pupils missed the claimed 2x maths goal.
5. Starlink/Starshield in Ukraine went down and came back. TechCrunch reported Starlink working normally again in Ukraine; Techmeme/WSJ said US officials credited Trump asking Elon Musk to restore the service. A sharp reminder of how much wartime infrastructure depends on one private network.
6. Quest Diagnostics confirmed a health-data breach. TechCrunch reported patients' personal and health data were compromised. Also in Cyber: State Bank of India suffered a customer PII leak, and Schneier flagged eMudhra TLS certificates issued with laughably weak private keys.

Other notable stories

• Instacart sale talks: TechCrunch reported Instacart, valued around $12B, discussed selling itself with DoorDash and Uber.
• Google privacy change: Techmeme/Android Authority reported Google clarified that data shared via Personal Intelligence from connected apps, including Gmail and Photos, could be used to target ads.
• OpenAI cluster: TechCrunch reported OpenAI will no longer train models on the live internet, whilst Gizmodo covered OpenAI's giant fake “offline internet” for agent training. Techmeme also reported Replit moving most AI spend from Anthropic to OpenAI in a $100M+/year deal.
• AWS capacity crunch: Andy Jassy said AWS capacity for 2027 is “largely sold out”, with a good chunk of 2028 also sold. AWS also launched “Infinity” for extreme agent concurrency, added Bedrock web-search domain filtering, and cut EMR on EKS charges by 30%.

Hacker News picks

From HN's front page, the standouts were Node2Shell evolving into HTTP2Shell, with a blast radius across many HTTP libraries and apps; OBS Studio 33; Twelve years of distributed SQLite; and the Apollo “no AI payoff outside tech” piece, which reinforced the biggest cross-source theme of the two days.

Overall theme: AI security and AI economics collided — AI is accelerating exploitation and attack automation, whilst the business payoff outside tech is being questioned more openly.

Sources: 157 items from FreshRSS (AWS, Cyber, Software Updates, Tech Dev, Tech Leadership, Technology), 22 Oct 18:17 – 24 Oct 18:17 Toronto, plus the Hacker News front page.