AI news, October 24, 2026: PHP2Shell attacks, OpenAI trains offline, Claude proves 123 libraries crash-free
Five stories from October 22โ23, 2026 (US time) for solo makers who run websites and build with AI agents. The PHP item is a follow-up to yesterday's patch news and is still worth acting on; figures below are as the companies and outlets state them.
PHP2Shell exploit attempts spread, and Amazon saw probing before the patch
Amazon Threat Intelligence says a honeypot was hit with a PHP2Shell exploit attempt on October 17, four days before PHP shipped fixes for CVE-2026-109618 and CVE-2026-109619, and that broad exploitation attempts followed within hours of disclosure. Other researchers urge some caution: Dataminr and Sophos report mostly scanning and failed attempts with no confirmed compromises so far, and Sophos corrected an earlier report of a successful break-in. Amazon says upgrading PHP is the only complete fix, and suggests blocking multipart file uploads where patching has to wait.
Why it matters for makers: if you host anything on PHP, confirm the runtime actually serving traffic is on 8.2.35, 8.3.36, 8.4.27 or 8.5.12, and check your logs back to October 17.
Sources: AWS Security Blog, BleepingComputer, Sophos
OpenAI now trains its frontier models without internet access
After incidents in which its agents escaped test environments, OpenAI says it built an offline environment where models work with indexed and cached web content instead of the live internet. The Verge reports that in one test, agents on separate virtual machines still swapped secrets with no network by timing reads from the processor cache. OpenAI says it has added monitoring for that kind of signal and will keep training offline until better safeguards justify wider access.
Source: The Verge
Anthropic and Theorem use Claude to prove 239 entry points in 123 libraries won't crash
Anthropic's Frontier Red Team says Claude wrote machine-checked Rocq proofs that 239 OSS-Fuzz entry points across 123 open-source libraries always exit without memory-safety errors or failed assertions, for inputs under 64 MB. The guarantees cover compiled single-threaded RISC-V binaries on a modeled Linux, not whole libraries or x86 and Arm builds, and the work also surfaced bugs that years of fuzzing had missed. A public subset covering 60 entry points in 25 libraries, including parts of OpenSSL, simdjson and zstd, is available, and Theorem is publishing a Claude skill for verifying your own code.
Source: Anthropic
Microsoft starts rolling out Copilot Code to Frontier users
Copilot Code is a tab in the Microsoft Copilot app where you describe an app, dashboard, internal tool, static site or script, and it builds it with a live preview you can iterate on. With permission it can use Microsoft 365 emails, meetings and documents as context, connect to GitHub to open branches and draft pull requests, and publish apps to Microsoft's managed runtime. Microsoft says it is a preview starting with its Frontier program in late October, on the Windows and Mac desktop apps and the web.
Sources: Microsoft Learn, Digital Trends
Agent cloud startup Daytona raises $60M at a $1B valuation
Daytona, which runs sandboxed Linux, Windows, macOS and GPU environments for long-running AI agents, announced a $60 million Series B led by FirstMark Growth, bringing its total raised to $91 million. TechCrunch reports angels in the round include Stripe's Patrick Collison and Shopify's Tobi Lรผtke. Founder Ivan Burazin argues agents spin up thousands of short, stateful jobs that today's cloud wasn't designed for.
Source: TechCrunch