Daily News Digest — 2026-10-23

Today's digest

Security dominated the last 24 hours. The PHP2Shell flaws in PHP were the biggest story: BleepingComputer reports Amazon saw exploitation attempts four days before patches shipped on October 21, while Slashdot carried the BBC's description of the situation as a "cyber equivalent of an unexploded bomb." Supply-chain and credential-exposure incidents piled up around it, including a compromised LiteLLM PyPI release, a Railway breach that exposed environment variables, a Capcom account breach affecting 11.7 million accounts, an actively exploited Arista VeloCloud zero-day and a new maximum-severity GitLab flaw. Slashdot also covered accidentally leaked Linux kernel vulnerabilities and Microsoft's reversal on a VPN fix.

AI and its business consequences ran through all three sites. Slashdot covered unvetted AI agents operating inside US bank accounts, Anthropic's launch of Claude Duet, Google DeepMind staff resigning over military contracts and Google paying customers to use less power for data centers. Digg's front page carried Anthropic's formal-verification results for Claude, a report that OpenAI fired three safety researchers, and several AI funding rounds (Warp Sciences, Legora, a new fund from Sequoia's Stephanie Zhan). Elsewhere, Digg led with entertainment, sports and gaming news, Slashdot noted the UN saying a breach of the 1.5C warming limit is now unavoidable, and Moderna's shares dropped sharply after a data leak.

Overlap between sites: the PHP vulnerabilities appear on both Slashdot and BleepingComputer, Slashdot's Windows VPN story is sourced from BleepingComputer, and Anthropic and OpenAI items appear on both Slashdot and Digg.

Must-read stories:

• Amazon says PHP2Shell exploitation began 4 days before patches (BleepingComputer)
• LiteLLM release pipeline hacked to distribute info-stealer malware (BleepingComputer)
• UN Says Breaching 1.5C Warming Limit Is 'Imminent and Unavoidable' (Slashdot)
• Unvetted AI Agents Are Accessing US Bank Accounts (Slashdot)
• Claude reportedly proved no-crash properties for 239 fuzz-test entry points across 123 libraries (Digg)

Slashdot

UN Says Breaching 1.5C Warming Limit Is 'Imminent and Unavoidable'

For the first time, the UN has declared that exceeding the Paris Agreement's 1.5C warming limit is "imminent and unavoidable," according to UN Environment Programme chief Inger Andersen. This year's emissions gap report examines overshoot scenarios, including limiting peak warming to 1.7 to 1.8C before bringing temperatures back down to 1.5C through emissions cuts and carbon removal. The report warns that each extra fraction of a degree raises the risk of irreversible changes to ice sheets, permafrost, ocean circulation and coral systems.

Unvetted AI Agents Are Accessing US Bank Accounts

Axios reports that major US banks are detecting unauthorized third-party AI agents operating inside customer accounts, some taking actions that appear independent of user instructions. Morgan Stanley has begun blocking third-party agents, and JPMorgan, Bank of America and Citi are also restricting them. Banks say they often cannot tell whether account activity is user-directed and are rewriting their terms of service.

To Make Way For Data Centers, Google Will Pay Others to Use Less Power

Google is expanding a deal with Voltus to fund one of the nation's largest "virtual power plants," which could provide up to 1,070 megawatts in the Mid-Atlantic PJM grid, roughly the output of a large nuclear reactor. Voltus will sign up homes and businesses and pay them to cut usage during peak demand, often automatically through smart thermostats and batteries. The New York Times reports that this could free grid capacity for data centers faster and more cheaply than new plants, though tech companies will likely still need traditional generation in the long run.

Microsoft Says October Updates Didn't Actually Fix VPN Issues

Microsoft says it mistakenly marked an Always On VPN bug as resolved in the October 2026 Windows 11 cumulative updates. The bug affects Windows 11 24H2 and later after the September updates: when the first connection attempt fails, VPN connections can stay stuck in a Connecting state or fail with a "port already in use" error. Microsoft says the status was wrongly changed to Resolved on October 13 and that a fix will ship later. The story originates from BleepingComputer.

The Browser Company Retires Its Arc Browser, Pushes Users to Dia

The Browser Company is shutting down Arc on December 22 and urging users to move to Dia, its AI-powered browser for Apple Silicon Macs and Windows 11. New Arc accounts can no longer be created, mobile tab sync and AI features end November 23, and desktop Arc stops working on December 22 when accounts are deactivated. The company says maintaining two browsers was hard to justify, particularly for security.

Moderna Shares Plunge After Leak of Cancer Vaccine Data

Moderna shares fell as much as 25% after partial trial data for its personalized cancer vaccine, developed with Merck, leaked. The full results showed the vaccine plus Keytruda cut the risk of recurrence or death in certain melanoma patients by 42% versus Keytruda alone, with about 82% of vaccine recipients alive without recurrence at two years versus 70%. Analysts, including BMO's Evan Seigerman, attribute the selloff to inflated expectations rather than weak results.

Bose Is Buying Skullcandy

Bose announced it is acquiring headphone brand Skullcandy, which will remain a separate company within Bose's Premium Consumer Audio business and stay in Park City, Utah. The two have worked together under the Sound by Bose licensing program since 2025. Bose CEO Lila Snyder told Wired that Skullcandy gives access to a customer base Bose is largely missing; Bose bought McIntosh Group in 2024.

Zoe Kleinman: PHP Is the Cyber Equivalent of an Unexploded Bomb

BBC technology editor Zoe Kleinman compares the newly found PHP vulnerabilities to an unexploded bomb, noting the global response to an attack that has not yet been confirmed. The AI-assisted discovery of long-hidden flaws led some sites to go offline as a precaution while administrators rushed to patch, after the planned quiet disclosure leaked. Surrey University's Alan Woodward describes the dilemma of alerting defenders without alerting attackers.

Anthropic Takes On Muse With Claude Duet

Anthropic launched Claude Duet, an agent for professionals and small businesses that competes with Meta's Muse and OpenAI's Dots. It sends a morning brief across connected apps, flags only items needing attention, and handles tasks from scheduling to building dashboards and forecasts using a virtual machine with a browser. It asks for approval before big steps like payments or deletions, and Anthropic calls it an early version that may misread threads or miscalibrate urgency.

Several Linux Kernel Vulnerabilities Accidentally Posted To Public Kernel Mailing List

Trend Micro's Zero Day Initiative appears to have accidentally posted several unpatched Linux kernel vulnerabilities to the public kernel mailing list instead of the private security list, per Phoronix. They include two CVSS 9.0 remote-code-execution flaws in SMB Direct and KSMBD, plus local privilege escalation and information disclosure bugs. Greg Kroah-Hartman queried the submissions, and at least one patch is already queued for expedited mainline merging.

Google Staff Resign In Backlash Over Its AI Contracts With Military

The BBC reports that several Google DeepMind employees have resigned or are leaving over Google's military AI contracts. Research engineer Sofia Liguori, who resigned this week, cites Google's growing work with the US and Israeli militaries and says it conflicts with the company's AI principles on human oversight. Current and former staff and experts worry about the level of human oversight at critical moments.

Digg

Tom Skerritt, 'Alien,' 'Top Gun' and 'Picket Fences' actor, dies at 93

Tom Skerritt died October 21, 2026, at 93; Variety says his publicist confirmed natural causes and Deadline says his family confirmed his death. His six-decade career included MASH*, Alien and Top Gun, and he won a 1993 Emmy for playing Sheriff Jimmy Brock on Picket Fences.

Warp Sciences launches with a $215 million Series A for AI and robotics in medicine development

Warp Sciences co-founder Kevin Weil says the company raised a $215 million Series A led by Lightspeed. It plans to use AI and robotics to develop new medicines faster. Weil says robotic labs will generate data to train scientific AI models and argues the US needs to bring critical scientific capabilities back from China.

Sequoia partner Stephanie Zhan is starting an early-stage AI fund

Stephanie Zhan says she is starting a fund to back AI founders from company formation, before product or market validation. Sequoia, Jeff Dean, Sachin Katti and Philip Wong will be among its limited partners. Zhan says she will remain a Sequoia partner and keep serving on its boards.

Call of Duty announces Modern Warfare 4 is live globally

The franchise announced Modern Warfare 4 is live globally, crediting Infinity Ward. Activision Blizzard Japan dates the worldwide release to October 23, 2026, across Xbox Series X|S, PlayStation 5, PC and Nintendo Switch 2. The game includes campaign, multiplayer and DMZ modes.

Amit Cohen and Ron Leshem reportedly set to write Marvel's Zodiac spy series

Deadline reports that Amit Cohen and Ron Leshem are set to write Zodiac, a Marvel spy thriller for Disney+, in which two spies chase targets with special abilities. Leshem was a creator of the original Israeli Euphoria, and he and Cohen created Trust No One. Deadline's expectations of 2027 production and a 2028 premiere are not confirmed.

Legora announces $550 million Series E at $8.8 billion post-money valuation

Legal AI company Legora announced a $550 million Series E at an $8.8 billion post-money valuation, led by Atreides Management. It puts annual recurring revenue above $200 million and says more than 140,000 legal professionals use its platform. The funds will go toward geographic expansion and further investment in Legora aOS.

Shai Gilgeous-Alexander's 20-point regular-season streak ends at 141 games

Gilgeous-Alexander's run of at least 20 points in regular-season games ended at 141 games when he scored 17 on 6-for-19 shooting against the Nuggets, The Athletic reports. The Thunder won their home opener against Denver. Bleacher Report described the streak as an NBA record.

Warhound emerges from stealth with a reported $200 million to develop gene-edited working dogs

Warhound has come out of stealth with $200 million, according to TechCrunch and WIRED. It plans to clone and gene-edit working dogs for military, law-enforcement and emergency-response roles. Ben Lamm says the initial edits will target health conditions, WIRED reports the first puppies are expected in early 2027, and Anduril's protective gear is still a plan.

SK Hynix halts review of Solidigm U.S. IPO and pre-IPO fundraising

CNBC reports SK Hynix has halted its review of IPO and pre-IPO options for its Solidigm subsidiary, citing market conditions and share-price trends. The move follows scrutiny from South Korea's financial regulator, which said a US listing could violate dual-listing rules. SK Hynix says Solidigm's investment needs are unchanged.

Prime Video renews Mike Flanagan's 'Carrie' for Season 2

Amazon MGM Studios announced the renewal on October 22, two weeks after the eight-episode first season's release, according to Deadline. Variety reports Season 2 will go beyond Stephen King's novel, and The Hollywood Reporter says Mike Flanagan remains showrunner. Prime Video's announcement covers only Season 2.

Claude reportedly proved no-crash properties for 239 fuzz-test entry points across 123 libraries

Anthropic reports that Claude found and patched bugs while producing machine-checked no-crash proofs for 239 fuzz-test entry points across 123 open-source libraries, working with Theorem over a few weeks. The proofs apply to specified RISC-V binaries under modeled Linux conditions and inputs under 64 MB, not to whole libraries or ordinary deployments. Theorem has launched a free offering.

OpenAI reportedly fired three safety researchers after security officers examined their phones

The Wall Street Journal reports OpenAI fired three safety researchers in September 2026 after a phone inquiry into suspected leaks of model-design information. Officers found that some had enabled disappearing messages in Signal chats with an outside safety researcher. Journal reporter Maxwell Zeff says the three had pushed on safety issues.

Canceled Mass Effect game's trailer circulates with 'Mass Effect: Universe' title card

A video presented as a trailer for the canceled next Mass Effect game circulated on October 22, 2026. Kotaku describes a "Mass Effect: Universe" title card, an apparent appearance by Liara T'Soni and a disclaimer about in-engine, pre-production footage. IGN called it an internal BioWare trailer, and Kotaku, which initially could not verify it, later said the trailer was real.

Michael Gray, Billy Batson on 1970s 'Shazam!' TV series, dies at 75

Michael Gray died October 16 at 75, his family told Extra, which reported natural causes. He played Billy Batson on CBS's three-season Saturday-morning "Shazam!" and also appeared in "The Brady Bunch" and in a cameo in the 2023 film "Shazam! Fury of the Gods."

76ers erase 29-point deficit, reportedly beat Cavaliers after Mitchell's buzzer-beater

Donovan Mitchell beat the first-quarter buzzer and had 22 points by halftime as Cleveland led. Philadelphia trailed by as many as 29 before the NBA tracked a 33-11 Sixers run; Tyrese Maxey cut the gap to seven and Joel Embiid put Philadelphia ahead in the fourth quarter.

Patriots touchdown ends first half against Bears

The NFL announced a Patriots touchdown to end the first half against Chicago, and UnderdogNFL identified Rhamondre Stevenson as the scorer. Sporting News, citing the NFL, described a 48-yard touchdown on the final play of the half.

Apple's first foldable iPhone, the Duo, reportedly launched Oct. 23, 2026

Sankei reports Apple's first foldable iPhone, the Duo, launched October 23, 2026, with a ¥364,800 direct-sale starting price in Japan. Screens measure 7.6 inches open and 5.4 inches folded. Citing MM Research Institute, Sankei says foldables were roughly 1% of Japanese smartphone shipments in fiscal 2025.

SpaceX reportedly seeking access to at least 80,000 US cell sites

Bloomberg reported on October 22, citing people familiar with the talks, that SpaceX aims to secure at least 80,000 US cell sites, with discussions that include Crown Castle. Tower access could help SpaceX pursue a nationwide mobile carrier alongside its satellite plans. Crown Castle's CEO declined to discuss specific customers, and the talks described are potential agreements, not signed leases.

Fifth 'Halloweentown' movie in early development at Disney

TheWrap reports Disney is in early development on a fifth 'Halloweentown' movie, with Lily Houghton and Ryan Koehn developing the script; the fourth film arrived in 2006. Variety says it would air on Disney Channel and Disney+ if greenlit, with no plot details and no confirmed casting.

MiniMax M3.1 Flash 428B is out, with an open-source DFlash 2 drafter

NVIDIA says MiniMax M3.1 Flash 428B is built for everyday coding and agents and claims Day 0 support on Vera Rubin, with up to 200K TPS/GPU and over 700 TPS/user. inco_ai says it open-sourced a DFlash 2 drafter for the model under Apache 2.0, claiming generation up to 3.5x faster without loss.

BleepingComputer

Railway warns devs to rotate secrets after potential breach

Cloud platform Railway warned that an unauthorized third party may have accessed encrypted environment variables and, in some cases, obtained their decrypted contents, which can include API keys and database or registry credentials. Railway has around 4.8 million users and hosts over 16 million services. It says the incident was part of a series of attacks on AI inference providers, urges all users to rotate secrets and check logs, and has paused all deployments during the investigation.

Capcom confirms data breach affecting 11.7 million accounts

Capcom confirmed hackers breached its CAPCOM ID membership service, exposing more than 11.7 million email addresses along with account creation date, last login timestamp, login count and last login IP address. For 43 accounts, dates of birth, gender, nicknames and countries were also exposed, and for 196 accounts the attackers changed passwords to lock owners out, which Capcom reset. Capcom says other passwords and credit card information were not exposed.

LiteLLM release pipeline hacked to distribute info-stealer malware

Hackers compromised LiteLLM's release pipeline on October 21 and pushed version 1.107.0 to PyPI and Docker, containing malware that steals credentials, secrets and environment variables. LiteLLM has 92 million monthly PyPI downloads and is used by companies including NVIDIA, Netflix, AT&T and Okta. The attacker modified only the installation package, adding files that run every time Python starts; security firms detected the attack within six minutes, and private enterprise customers were not affected.

Arista patches new VeloCloud Orchestrator zero-day exploited in attacks

Arista patched CVE-2026-114625, an actively exploited critical SQL injection flaw in on-prem VeloCloud Orchestrator that lets any authenticated user gain operator privileges and masquerade as a superuser. Hosted deployments are already patched in versions 5.2.3.18, 6.1.3.10 and 6.4.2.12 or later. Until patched, Arista advises restricting access to the web interface, reviewing admin activity and logs, and blocking IPs 74.82.197.86 and 38.54.50.151.

Microsoft shares how to fix broken Exchange Online EWS apps

Microsoft says admins can re-enable the Exchange Web Services API in Exchange Online for apps that broke after EWS began being blocked by default on October 1, 2026. Admins can uncheck "Block your entire organization from using EWS" in Baseline Security Mode or run Set-OrganizationConfig -EWSEnabled $true, which takes up to 4 hours. Re-enabling stops working in April 2027, and Microsoft recommends vendors and developers move to Microsoft Graph.

Machine speed attacks require machine speed detection and response

This sponsored analysis by Exaforce says attackers now enumerate or pull data within 15 minutes of gaining access. In one case, an unused GitHub Desktop OAuth token sat in a Mac's keychain for 95 days before someone used it to pull 76 repositories in about 15 seconds, ultimately exfiltrating data from 472 of 638 repos even though Exaforce's platform flagged it within five minutes. The article argues for behavior-based detection and automated response.

Amazon says PHP2Shell exploitation began 4 days before patches

Amazon Threat Intelligence says attackers began targeting the PHP2Shell flaws (CVE-2026-109618 and CVE-2026-109619, both critical remote code execution) on October 17, four days before PHP patched them on October 21. The PHP team had to accelerate its release after details leaked, and the UK's NCSC urged organizations to patch or take PHP servers offline. Amazon saw multiple actors and proof-of-concept exploits from anonymized IPs hours after disclosure.

GitLab warns of new max severity code execution vulnerability

GitLab patched CVE-2026-110264, a maximum-severity integer overflow in its Regular Expression Compiler that could let unauthenticated attackers run arbitrary code on servers. Fixes are in CE/EE versions 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10 and 18.11.13, and GitLab.com is already patched. Shadowserver tracks over 2,700 exposed GitLab CE instances, and this is the second critical flaw in the same component from the same researcher in ten days.