Skip to main content

Anthropic files to go public as PHP and .NET flaws demand patching

  1. Business

    Anthropic files for Nasdaq IPO under ticker ANT, revealing $16.3B half-year revenue (opens in a new tab)

    Anthropic filed its S-1, reporting $16.3 billion in revenue and an $80.7 billion net loss for the first half of 2026, mostly from revaluing convertible notes. As the first frontier lab to open its books, it shows builders what frontier AI really costs.

    Source: Anthropic

  2. Security

    PHP2Shell flaws now confirmed exploited for remote code execution in the wild (opens in a new tab)

    Perplexity researcher Adel Karimi's honeypots caught 35 shells from two IP addresses on October 24 using the critical PHP2Shell bugs, CVE-2026-109618 and CVE-2026-109619. Any server running PHP for web requests should be on 8.5.12, 8.4.27, 8.3.36 or 8.2.35 now.

    Source: BleepingComputer

  3. Security

    Microsoft ships emergency .NET patches for critical Brotli decoder flaw (opens in a new tab)

    Out-of-band updates for .NET 8, 9, 10 and 11 RC3 fix CVE-2026-111497, a Brotli buffer overflow that can let unauthenticated attackers read or corrupt memory. Apps using ASP.NET Core request decompression, HttpClient auto-decompression or Brotli APIs should update first.

    Source: .NET Blog

  4. Security

    Rogue AGENTS.md in Downloads folder tricked AI coding agent into installing malware (opens in a new tab)

    Forever Security traced a coding agent's attempt to install the malicious npm package function-color to an AGENTS.md in a user's Downloads folder, and in tests the trick worked on Codex in more than 90% of runs. Never start coding agents in Downloads.

    Source: Help Net Security

  5. Regulation

    China clears DeepSeek and MiniMax to keep exporting AI under new export rules (opens in a new tab)

    Beijing added 23 AI technologies, including large models and agents, to its draft export-restricted catalogue, then a CCTV-affiliated account said DeepSeek and MiniMax had won state approval for global use. Open-source exports get simplified licensing, so teams using Chinese open-weight models should see little change.

    Source: The Register

  6. Business

    Microsoft offers voluntary buyouts to around 60,000 employees (opens in a new tab)

    Microsoft opened a voluntary exit offer to staff at VP level and below on select teams in the US, Canada, India and UK, per reports and a note from Chief People Officer Amy Coleman. It's another sign Big Tech is reshaping headcount around AI spending.

    Source: TechCrunch

  7. Cloud

    Tesco is replacing VMware with Proxmox across its store edge estate (opens in a new tab)

    A Tesco job ad describes migrating the UK grocer's in-store edge virtualisation from VMware to open-source Proxmox, while Tesco sues VMware and Broadcom for at least £100m over perpetual licences. It is a high-profile sign that big enterprises will leave VMware for open alternatives.

    Source: The Register

My take

Anthropic's filing will grab the headlines, but the stories that should cost engineers sleep this week are older and duller: PHP and .NET both needed emergency fixes for memory bugs in request-handling paths most teams never think about, and a plain Markdown file was enough to turn a coding agent against its owner. All the money pouring into AI hasn't changed the basic threat, which is still untrusted input reaching something that obeys it. If your team is adopting agents faster than it is patching runtimes, flip that order. Patch PHP and .NET today, then lock every agent to its project folder.