Published on LinkedIn and amitabhapte.com | 25 October 2026
Key developments and opinions which caught my attention this week.
This Is What I Read This Week
The story of the week started with a patch. AI tools found two flaws in PHP, the language behind roughly 70% of websites, that had sat unnoticed in the code for more than a decade. The flaws, now called PHP2Shell, allow remote takeover of an unpatched server. PHP shipped fixes on 21 October, and security agencies told anyone who couldn’t patch to take their sites offline. Many did. The Dutch cyber security centre pulled its own public sites, the Port of Rotterdam went dark, and France’s Interior Ministry put every website into maintenance. The tech giants’ response showed both sides of AI in security. Google’s Wiz used AI models to find the flaws, and OpenAI spent about two months coordinating a coalition to prepare fixes. Amazon’s threat team still spotted exploitation attempts before the public disclosure.
Trust was also the theme on Etsy, which banned AI-generated recipes and patterns. Sewing patterns, crochet instructions and other how-to downloads made by AI are out, along with listings built entirely by bots. Every listing now needs at least one unedited photo of the real item. AI art stays, with disclosure. Etsy says buyers’ uncertainty about AI content is a top-three barrier to shopping more.
On distribution, OpenAI is bringing its models to Google Cloud. Its latest models and Codex will sit in Google’s Model Garden, and customers can pay with their existing cloud commitments. OpenAI’s exclusive deal with Microsoft ended in April, and it is already on AWS. Meanwhile, Anthropic launched Claude Duet, an agent that reaches out before you ask. It sends a morning brief, checks your connected apps every few hours, and asks for approval before it sends messages, makes payments, signs documents or deletes files. It is a US-only research preview for now.
And the hardware kept moving. Apple’s first foldable, the iPhone Duo, costs $1,999 and sold out on preorder. Reviewers praised the hinge and the screen, but many apps aren’t yet optimised for it, and some suggest waiting for the second generation.
So What? My PoV and Takeaway This Weekend
This week showed AI as both the lock-picker and the locksmith. Machines found flaws that humans missed for ten years, and attackers were probing them before most of us had heard the name. The time between discovery and exploitation is collapsing. Annual penetration tests and quarterly patch cycles belong to a slower world. If AI can read every line of the code we depend on, we have to assume someone else’s AI is reading it too.
Etsy drew a line I think will spread. AI is welcome where it helps people create, and banned where people rely on its output to work: a recipe that has to cook, a pattern that has to fit. That distinction, between creative content and functional content, applies to every brand that publishes instructions, specifications or advice. If a customer acts on it, a human should have tested it.
My takeaways this week. Measure patch speed in hours and days, and know where your legacy code lives, including the websites your marketing agencies built years ago. Write a simple rule for AI-generated content that customers will act on: tested by a person, or not published. And as models arrive on every major cloud, choose on governance and fit, because access is no longer the differentiator.
The question I’m taking into next week: if AI can find a decade of hidden flaws in a few weeks, what is it about to find in ours?
