Daily · AI Security and Global Tech Shifts · October 23, 2026

Key points

PHP2Shell: AI-Discovered Flaws Trigger Global Patching

Two critical remote-code-execution vulnerabilities in PHP, designated CVE-2026-109618 and CVE-2026-109619 (dubbed PHP2Shell), were disclosed on October 21 after being identified by AI-assisted research. The flaws, which allow attackers to execute code without authentication, affect all PHP versions back to 5.4. Wiz Research and Datadog Security Labs confirmed that application-level authentication cannot prevent the attacks because the malicious request is processed before application code runs.

The discovery was driven by AI models; Calif used OpenAI's GPT-5.6 Sol, while Wiz independently found the bugs using Google's models. Both firms noted the vulnerabilities had existed for over a decade but were difficult for humans to weaponize. Following the leak of CVE numbers on October 20, emergency patches were released for all supported versions by 14:00 UTC on October 21. Zend and other providers also patched end-of-life versions.

The impact was immediate and severe. Cloudflare reported thousands of attack attempts before the announcement, rising to millions within hours. Governments in Germany, France, Belgium, and Finland took public websites offline as a precaution. The FBI and UK National Cyber Security Centre issued alerts urging organizations to take affected systems offline if patching was not feasible. Anthropic's deputy CISO Jason Clinton warned of a coming 'vulnerability tsunami,' stating that the cybersecurity landscape is likely to get 'a lot worse' before it improves, urging organizations to isolate sensitive networks for approximately 18 months.

EU Council Approves AI Data Processing Amendment

On October 21, the EU Council approved a proposed amendment to the GDPR (Article 88bis) that would make processing personal data 'in the context of AI' automatically lawful without requiring user consent. The provision, part of the 'Digital Omnibus' Proposal, allows any AI system to lawfully access personal data by default. NOYB's Max Schrems criticized the move, arguing that no material safeguards are required and that it represents a 'digital expropriation' of European data for AI companies.

The agreement was reached with support from Germany and other EU powerhouses, using a fast-track procedure that bypassed a fundamental rights assessment. The Council must now negotiate final wording with the European Parliament in trilogues. Additionally, member states proposed narrowing the definition of 'personal data' using 'pseudonyms,' which could exclude systems using user IDs, tracking IDs, or IP addresses from GDPR coverage.

Solidigm IPO Halt and Semiconductor Market Volatility

SK Hynix announced on October 23 that it would halt its review of a potential US IPO for its subsidiary Solidigm. The decision cited recent capital market conditions and share price trends, with the Nasdaq Composite sliding 2.6% on Thursday, its worst session since June. Reports had suggested the IPO could value Solidigm at up to US$150 billion.

South Korea's Financial Supervisory Service warned that a US listing could violate rules restricting dual listings, potentially diluting existing shareholders' stakes. SK Hynix stated that tighter government restrictions were not the direct reason for the halt but that it will continue exploring funding options for a new US semiconductor fabrication plant to meet AI-driven memory demand.

Moderna Cancer Vaccine Data Leak and Market Reaction

Moderna shares dropped as much as 25% on October 23 following the premature publication of embargoed Phase 3 trial data for its cancer vaccine intismeran, developed with Merck. The full results showed a 42% reduction in melanoma recurrence or death risk when paired with Keytruda, with a hazard ratio of 0.58. The data was leaked by Oncology Central before the scheduled presentation at the European Society for Medical Oncology conference in Madrid.

Despite the positive clinical outcomes, the leak triggered a 'sell-the-news' reaction. William Blair analyst Myles Minter questioned whether the decline reflected concern over efficacy differences across mutational burden levels. The trial enrolled about 1,100 patients, and overall survival data were not yet mature, though companies noted a 'favorable trend.' Merck and Moderna plan to pursue regulatory approval.

HSBC Launches RedCoin Stablecoin in Hong Kong

HSBC debuted RedCoin (RCHKD), a Hong Kong dollar stablecoin, on its PayMe app, allowing over 3.3 million users to send money and pay at more than 100,000 merchants. The launch follows HSBC's receipt of one of Hong Kong's first stablecoin issuer licenses in April 2026. RedCoin is fully backed by high-quality liquid assets held in separate accounts.

HSBC plans to integrate RedCoin into its mobile banking app by year-end, enabling subscriptions to tokenized investment products, including a new share class of its Hong Kong dollar money market fund with a minimum investment of HK$100. The bank has supported US$8.3 billion in digitally native bonds globally and aims to introduce cashback rewards to encourage stablecoin spending.

Starlink Restrictions and Ukraine Conflict Developments

US President Donald Trump stated that Elon Musk restored Ukraine's access to the Starlink satellite network, which had been subject to speed restrictions since October 13. The Ukrainian military reported using the network without restrictions at maximum speed, though some officials noted that full functionality was not yet restored and speed limits of 140-160 km/h were still observed in tests.

The incident sparked a congressional inquiry into how SpaceX's technology was 'degraded for Ukraine without notice.' Senator Blumenthal sent letters to Musk and Defense Secretary Pete Hegseth. Meanwhile, Trump and Putin discussed trilateral talks on Ukraine, with Putin stating that Russia and the US agreed to resume negotiations focused on post-war security guarantees.

AI-Driven Workforce and Infrastructure Shifts

American Express announced it is cutting 5% of its global workforce (approximately 3,850 employees) and taking a $336 million restructuring charge to 'prepare for AI.' CEO Stephen Squeri stated the company will only allow AI agents to access systems through approved API or MCP channels. In parallel, RBI issued an advisory directing Indian banks to forensically clear tech environments after CERT-In warned of AI-agent-driven attacks that compressed attack timelines from days to hours.

In infrastructure, Schneider Electric agreed to acquire PTC for $22.6 billion, its largest-ever deal, signaling convergence between industrial electrification and grid software. Nvidia's Jensen Huang visited Kazakhstan, positioning the country as an AI computing hub for Europe with plans for a $10 billion investment in GPU clusters. Additionally, Bitcoin Core maintainers merged a policy change ending the embargo for vulnerabilities discoverable by simple AI prompts, reflecting the accelerating pace of AI-assisted security research.

Our read

The PHP2Shell incident marks a turning point where AI-accelerated vulnerability discovery has outpaced traditional patching cycles, forcing organizations to prioritize network isolation and rapid response over long-term fixes. The EU's GDPR amendment poses a significant compliance risk for any organization processing personal data in AI contexts, potentially stripping away consent-based protections that have defined privacy law for decades. For financial institutions, the explicit restructuring of workforces around AI automation, as seen at American Express, signals that AI-driven efficiency is now a board-level agenda item with direct implications for headcount and operational risk.

This material was produced automatically by a large-language-model system from the public sources listed below; it is AI-generated content and may contain inaccuracies — verify facts against the original sources.

Sources