AI news, October 23, 2026: PHP2Shell patch, Claude Duet, Agent Skills joins AAIF
Six stories from October 21โ22, 2026 (US time) for solo makers who run websites and build with AI agents. The first item is a security fix worth acting on today; product details and figures below are as the companies and outlets state them.
PHP patches two critical "PHP2Shell" flaws that AI helped uncover
The PHP project released PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 on October 21 to fix two vulnerabilities rated CVSS 9.2 that, under the right conditions, let an unauthenticated attacker run code on a server or read process memory. Wiz says every PHP version back to 5.4 is affected by at least one of the issues, and that frontier AI models made it practical to chain the long-standing flaws into working exploits. A researcher at Calif first reported the bug using GPT-5.6 Sol through OpenAI's Patch the Planet program, and OpenAI has published a PHP version checker as a Codex skill.
Why it matters for makers: if any of your sites, WordPress installs or APIs run on PHP, update the PHP runtime itself and restart PHP-FPM, Apache and long-running workers; updating your app alone is not enough.
Sources: The PHP Foundation, Wiz Research, OpenAI
Anthropic opens a research preview of Claude Duet, a background work agent
Anthropic launched Claude Duet, an agent app for professionals and small businesses that can build a daily briefing, create dashboards and suggest actions from a user's connected data. It runs on Claude Opus 5.5, works in the background on its own virtual machine, and asks for approval before sensitive steps such as payments. TechCrunch reports it is available on iOS, Android and Claude.ai for Pro and Max customers through a waitlist.
Source: TechCrunch
Anthropic donates the Agent Skills standard to the Agentic AI Foundation
Anthropic is handing Agent Skills, the format where a folder with a SKILL.md file teaches an agent a task, to the Agentic AI Foundation under the Linux Foundation, which already hosts MCP. Anthropic says more than 70 agent platforms, including ChatGPT, Cursor, GitHub Copilot and VS Code, have integrated the standard. The donation includes the name, logo, GitHub organization and the agentskills.io domain, with a proposed roadmap covering versioned releases and security guidance for skill authors.
Why it matters for makers: a skill you write once is more likely to keep working across different agent tools as the format moves to a vendor-neutral home.
Source: Anthropic
OpenAI makes its Decisions API generally available
OpenAI's Decisions API, built on GPT-6 Luna, is now generally available for fast questions with bounded answers, such as classifying an input or routing a request. OpenAI says it answers up to 10x faster than GPT-6 Luna through the Responses API. Since the beta it has added prompt caching, native JSON inputs, images in instructions and up to 400 questions per request.
Why it matters for makers: small routing and classification steps inside an app or agent can be moved to a cheaper, quicker endpoint instead of a full model call.
Source: OpenAI
Canva releases Canva Craft, its first in-house image model
Canva's new image model plans a layout first, including element positions, scale and text, and then generates an image of up to 2K resolution in 30 aspect ratios. Canva says it was trained on human-designed templates rather than photos, so results can be turned into editable layered designs. It is available to all Canva users in the Dream Lab tab and is coming to the Canva API, with faster, cheaper versions planned.
Source: TechCrunch
1Password launches a way for agents to log in without seeing passwords
1Password for Agents lets a user approve each login attempt from an AI agent, after which 1Password fills in the credentials so the agent never holds the password itself. TechCrunch reports it works with agents including Claude Duet, OpenAI's Dots and ChatGPT Work, Grok Bot, Meta's Muse and Town. 1Password says the aim is to stop people pasting credentials into agents, where copies can end up stored out of their control.
Source: TechCrunch