AI
OpenAI models find critical security flaws in PHP, powering 70% of the web
OpenAI announced that its models, working under the company's Patch the Planet initiative, discovered critical security vulnerabilities in PHP — the open-source language estimated to underpin roughly 70% of websites worldwide. Over the past two months, OpenAI led a coalition of maintainers and researchers to identify and patch the flaws, a move that commentators like Box CEO Aaron Levie called a preview of how AI agents will systematically hunt down long-standing risks across global infrastructure.
For site owners concerned about exposure, OpenAI packaged a Codex skill that walks users through checking whether their website is affected, pointing to a dedicated repository to guide the process.
OpenAI models and Codex agentic workflows coming to Google Cloud's Model Garden
OpenAI said its frontier models and Codex agentic workflows will be available through Google Cloud's Model Garden, allowing enterprises to access OpenAI technology directly within the infrastructure where they already build. The partnership marks a notable expansion of OpenAI's distribution beyond its own platform and Azure.
Anthropic launches Duet always-on personal agent and publishes annual Public Benefit Report
Anthropic launched Duet, described as an always-on personal agent that early testers are calling the first AI agent worthy of being called a pro tool. Reviewers who had access for two weeks say it has meaningfully shifted their day-to-day usage away from ChatGPT. Separately, Anthropic published its annual Public Benefit Report outlining the five pillars guiding its work as a Public Benefit Corporation, and announced that experimental physicist and former Harvard Dean of Science Dr. Christopher Stubbs is joining its Long-Term Benefit Trust.
Consumer Tech & Gadgets
iPhone Duo reviews draw harsh criticism, but Gurman says app issues will resolve within weeks
Reviews of Apple's iPhone Duo are among the most negative Gurman has seen for an Apple product in years, rivaling the reception of the Vision Pro. The core complaint centers on app optimization — third-party apps not yet fully adapted to the Duo's form factor — but Gurman argues this is a temporary problem that will be resolved within weeks, drawing historical parallels to the rocky launches of the iPhone 5 and iPhone 6 Plus.
Gurman did note one meaningful distinction from past launches: while developers had only one week to prepare for the iPhone 5 and iPhone 6 Plus, they have had over a month of lead time plus hands-on development opportunities ahead of the Duo's release — making the current state of app optimization harder to excuse. Separately, Wall Street Journal reviewer Joanna Stern encountered her own Duo-related friction when X incorrectly flagged her iPhone Duo review video as AI-generated, forcing her to publicly clarify that the footage was entirely shot, edited, and animated by humans.
Design
Apple unveils new Apple Music brand identity with updated visual language
Apple has officially announced a refreshed brand identity for Apple Music, rolling out updated visuals including a new look for the service's page and, potentially, a new app icon. The rebrand drew strong reactions from the design community, with Andreas Storm's breakdown of the identity earning over 3,000 likes, and Oliur calling it 'a redesign that's actually great for once,' a rare endorsement in a space often skeptical of corporate rebrands.
Apple's updated Apple Music page went live shortly after the announcement, and Storm flagged what appears to be a new app icon in the pipeline, suggesting the visual overhaul extends beyond marketing materials into the product itself.
Figma CEO teases end-to-end agentic workflow integration coming to the canvas
Figma CEO Dylan Field publicly signaled that agentic AI workflows are nearly ready to ship inside Figma end-to-end, responding to a demo from Harvey showing how agentic pipelines can be combined with the Figma canvas and Weave. Field's 'we're so close' suggests a meaningful product announcement is imminent rather than exploratory.
Dev Tools & Infrastructure
Critical PHP RCE flaws (php2shell) prompt emergency patches and WAF responses from Vercel and others
Two critical remote code execution vulnerabilities in the PHP engine, tracked as php2shell, affect PHP 5.4 and later, with public exploits already circulating. Users are urged to patch immediately to PHP 8.2.35, 8.3.36, 8.4.27, or 8.5.12. Vercel shipped WAF mitigations before the public disclosure and reports those rules have already blocked exploit attempts against PHP origins on its platform.
Vercel CEO Guillermo Rauch described coordinated behind-the-scenes industry cooperation in the weeks before disclosure to protect shared infrastructure, calling it inspiring and warning that further attempts should be assumed as attackers probe the vulnerability.
GitHub and Microsoft Research launch Chopin proof-driven kit to ship AI-generated code without line-by-line review
GitHub Next and Microsoft Research have released a research preview of Chopin paired with a Proof-Driven Development Kit, a toolchain designed to let teams deploy AI-generated code to production without manually reviewing every line. The project claims stronger correctness assurance than conventional code review and testing alone, using formal proofs to validate AI output before it ships.
Vercel WebSocket support reaches GA; Deno patches eMudhra certificate vulnerability in v2.9.8
Vercel announced general availability of WebSocket support in Vercel Functions, saying the platform now handles 15 million WebSocket connections per day across AI chat, streaming, and real-time multiplayer use cases. Separately, Deno released v2.9.8 as a security-focused update that distrusts the compromised eMudhra certificate authorities to address a supply-chain trust vulnerability, alongside 12 additional security and bug fixes. Developers on both platforms are encouraged to upgrade immediately.
Gaming
EA Shuts Down BioWare and Cancels Next Mass Effect Amid 400-Person Layoff
Electronic Arts has confirmed it is shutting down BioWare, ending development on the next Mass Effect and eliminating roughly 50 roles at the studio as part of a broader round of approximately 400 layoffs across the company. The news lands as a decisive end to one of gaming's most storied RPG studios, responsible for the original Mass Effect trilogy and Dragon Age series.
Industry veteran and The Game Awards host Geoff Keighley called the news heartbreaking, reflecting on his collaboration with BioWare's Casey Hudson on the Mass Effect teaser revealed during the height of COVID in 2020. "I hope one day, somehow, Mass Effect will return," Keighley wrote, underscoring the sense of finality felt across the industry.
EA Confirms DICE and Respawn Are Collaborating on a New Project, Fueling Star Wars Battlefront 3 Rumors
EA has officially confirmed that DICE and Respawn Entertainment are jointly working on a new, as-yet-unannounced project. The confirmation adds significant weight to longstanding rumors that the collaboration is producing Star Wars: Battlefront 3, a sequel fans have been awaiting since 2017.
Xbox Cloud Gaming Launches Pay-As-You-Go Hour Packs Starting at $3.99
Microsoft has revealed introductory pricing for Xbox Cloud Gaming on an hourly basis: 10 hours for $3.99, 25 hours for $7.99, and 50 hours for $11.99. The tiered, pay-as-you-go model marks a notable shift in how Xbox is positioning cloud access, offering an entry point for players who do not want a recurring subscription.
Layoffs & Industry Shakeups
JPMorgan Shutting Down Turkish Securities Unit
JPMorgan's securities unit in Turkey announced plans to cease operations in the country, marking a notable withdrawal by one of Wall Street's largest banks from the Turkish market.
Security
PHP releases emergency patches for two critical RCE flaws under active exploitation
PHP has issued emergency patches for two critical vulnerabilities tracked as CVE-2026-109618 and CVE-2026-109619, both carrying a CVSS score of 9.2, as early exploit attempts are already being observed in the wild. Dubbed PHP2Shell, the flaws affect the PHP runtime itself rather than any specific application framework, meaning updating WordPress or Laravel alone provides no protection. Apache mod_php, PHP-FPM, php-cgi, FrankenPHP, and LiteSpeed are all affected, with mod_php having a demonstrated single-request unauthenticated RCE path. CISA has issued an urgent advisory calling on all organizations to patch immediately.
Fixed versions are PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. Beyond remote code execution, researchers also demonstrated that the flaws allow reading live PHP worker memory without prior code execution, potentially exposing passwords, session tokens, API keys, and certificates from other active requests. Disabling session.upload_progress blocks some CVE-2026-109619 attack paths but does not fully mitigate either flaw. Administrators should restart Apache, PHP-FPM, and any long-running workers after applying patches.
GitLab discloses CVSS 10.0 flaw enabling unauthenticated RCE across 12 years of releases
GitLab has disclosed CVE-2026-110264, a maximum-severity vulnerability with a CVSS score of 10.0 that affects self-managed GitLab servers spanning roughly 12 years of releases. The flaw can allow an unauthenticated attacker to achieve remote code execution, making it one of the most severe GitLab vulnerabilities on record. Self-managed GitLab administrators should treat patching as an immediate priority.
India investigates eMudhra after CA private keys found trivially recoverable, CERT-In issues advisory
India's IT Ministry has launched a special investigation into certificate authority eMudhra after eight intermediate CA private keys were found to have P-384 key values below 256, making them mathematically recoverable from publicly available certificate data. CERT-In issued advisory CICA-2026-3649, and Red Hat separately warned that RHEL 6 through 10 and container-based environments may continue trusting the compromised certificate hierarchy until their trust stores are explicitly updated, meaning browser-level revocations alone may not be sufficient protection. The fallout has extended beyond Chrome and Firefox to affect Go toolchains as well.
eMudhra has stated that seven of the affected intermediate CAs were never deployed and that the eighth issued no end-user certificates, and the government confirmed that India's regulated Digital Signature Certificate and eSign services were not impacted. However, a significant unanswered question remains: how such critically weak cryptographic keys went undetected for approximately 18 months within a trusted certificate authority.
Startups & Funding
YC-backed Stepful raises $55M Series C after training 30,000 healthcare workers
Stepful, the Y Combinator S21 healthcare workforce startup, has closed a $55 million Series C round after training 30,000 students last year alone. The company, which places graduates into clinical and allied health roles, now counts 39 health systems as clients, including seven of the ten largest in the United States, underscoring demand for workforce pipelines at a time of persistent healthcare staffing shortages.
Stripe and Stratechery announce content partnership
Stripe has announced a new partnership with Ben Thompson's Stratechery, with CEO Patrick Collison calling Thompson "the best analyst in tech" and expressing enthusiasm for the collaboration. The deal pairs one of fintech's most prominent infrastructure companies with the subscription media outlet widely read across Silicon Valley, though specific terms of the arrangement were not disclosed.