Good morning. Today's Factwire: an urgent PHP fix for website owners, Anthropic's Claude Duet agent app, and Gemini getting personal in your car.
PHP patches two flaws that let attackers take over web servers
In one line: PHP fixed two critical bugs that let strangers run code on web servers.
What happened:
The bugs, CVE-2026-109618 and CVE-2026-109619, are rated CVSS 9.2 and fixed in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
PHP 8.1 and older get no fix from the PHP project. CISA advised taking PHP systems offline if they cannot be patched right away.
Cloudflare turned on protection for all WAF plans, free included, and reported attack traffic.
Why it matters: If your website runs on PHP, a quick check could keep it from being hijacked.
PHP, Oct 21, 2026. Also: CISA, Oct 21, 2026; Cloudflare, Oct 21, 2026.
Factwire's take: The fix is simple and waiting is risky, so ask your host today.
Hit reply: do you know your site's PHP version?
Claude Duet is a new agent app that comes to you first
In one line: Anthropic opened a waitlist preview of Claude Duet, an app that checks your connected apps every few hours and keeps working while you are away.
What happened:
It starts with US Pro and Max subscribers, runs on iOS, Android and claude.ai, and shares your plan's usage limits.
It sends a short morning brief and asks for your approval before it sends a message, pays, signs or deletes anything.
Why it matters: This is aimed at busy professionals and small business owners who want an assistant that speaks up first, not one that waits to be asked.
Anthropic, Oct 21, 2026.
Gemini in your car is starting to use your Gmail, Calendar, Maps and Photos
In one line: Google brought Gemini to Android Auto and cars with Google built-in worldwide. It is also rolling out Personal Intelligence, which uses your own Google apps, starting with Android Auto.
What happened:
Personal Intelligence is opt-in: your apps stay unconnected until you turn it on, and you can switch it off in Gemini settings.
Once on, you can ask things like your flight gate or the car wash from last week's photo without touching your phone.
Why it matters: Handy hands-free answers are a real safety plus, but it is your call how much of your inbox and photos the car gets to see.
Google, Oct 20, 2026.
Start here
Try this: check your website's PHP version
Prompt: My website runs on PHP. Show me how to find its PHP version, and tell me which of 8.5.12, 8.4.27, 8.3.36 or 8.2.35 fixes it.
Paste the prompt into your AI chat and follow its steps, or look in your web host's control panel.
If your version is older than the fixed ones, ask your host to update it.
Word of the week: Remote code execution. It means an attacker can run their own commands on your computer from far away, which is why the PHP bugs are critical.
Wires
A DHS order published Oct 20 bars DeepSeek from federal civilian systems. Federal Register, Oct 20, 2026.
Anthropic plans to put 5% of its shares in a public benefit fund, pending a stockholder vote, with labor market impacts as one example use. Anthropic, Oct 18, 2026.
xAI says a Grok Bot teammate cleared 204 support tickets in about 10 minutes on Sep 18, with an engineer approving. xAI, Oct 20, 2026.
An AI trained on over 40 million face photos was tuned to estimate cancer survival, which could help gauge risk when other tests are unavailable. The Lancet Digital Health, Oct 19, 2026.
Per @bot on X, you can now set Grok Bot as your iPhone's Action Button and press it to talk with Bot. @bot on X, Oct 19, 2026.
Google is rolling out a Gemini small business hub that reuses your brand style in visuals and turns receipts and spreadsheets into financial graphics. Google, Oct 20, 2026.
Using AI for something? Hit reply and it might land in Reader's corner.
Hit reply, what should we cover next?
Know someone who keeps asking you about AI? Forward them this email. They can join Factwire free at www.factwireai.com/subscribe
Next drop on Monday. Have a great day and enjoy your weekend.