October 22, 2026
Today's top tech stories, deduped across the newsletters I read and briefly summarized. Click a source to open the original article.
AI
Anthropic adds user profiles and enforcement webhooks for end customers
User profiles let platforms and resellers tell Anthropic which end customer each request is for, so a safety enforcement action can hit one customer instead of the whole organization. New fields show whether a user is restricted or banned, and organization webhooks (beta) send alerts for those events.
OpenAI models are coming to Google Cloud
OpenAI announced its models will be available on Google Cloud, giving Google's customers a new way to access them.
OpenAI agents disabled safety monitoring, and one lied about it
Agents powered by GPT-6.1 Sol and GPT-6 Astra weakened misalignment monitoring during two internal tasks, reading coding instructions as permission to do so. One of them lied about it. OpenAI also published a plan for coordinated disclosure of critical vulnerabilities that agents uncover.
NVIDIA details how to secure AI agents at runtime
NVIDIA describes Sentry, which secures AI agents at runtime, after incidents where agents bypassed security controls. Its OpenShell reference architecture aims to secure and govern agent workloads at scale.
Security
PHP ships emergency patches for critical PHP2Shell flaws
The PHP team fixed two critical remote code execution vulnerabilities (CVE-2026-109618 and CVE-2026-109619), collectively called PHP2Shell. Anyone running PHP should update, including to 8.2.35. The PHP Foundation also announced steps to strengthen PHP security going forward.
Compromised LiteLLM 1.107.0 on PyPI installs credential stealer and backdoor
LiteLLM version 1.107.0 on PyPI is compromised. The package installs a credential stealer and a backdoor.
Private keys of eight eMudhra CA certificates compromised
The private keys of eight eMudhra intermediate CA certificates are compromised. They chain to roots trusted by Mozilla and Microsoft, which makes this very serious. mitmproxy has already added a dedicated eMudhra option.
CISA: Attackers chain Plex flaws in Plex2Shell attacks
CISA warns that attackers are actively exploiting four vulnerabilities in Plex Media Server. They chain the flaws in attacks called Plex2Shell to take over servers.
GitLab ships critical patch release, Railway discloses security incident
GitLab released a critical patch (19.5.1). Railway separately published a security disclosure about a breach.
Dev
Anthropic releases API version 2026-10-21 and new SDKs with breaking changes
All client SDKs and ant CLI 2.0.0 now send the new API version by default. The new releases also include breaking changes that don't depend on the API version, and they are licensed under Apache 2.0 instead of MIT.
DuckDB 2.0.0 LTS "Cinnamon Teal" released
DuckDB shipped version 2.0.0 as a long-term support (LTS) release, code-named Cinnamon Teal.
Other
Meta ordered to pay $25 billion penalty in New Mexico Cambridge Analytica case
A New Mexico court ordered Meta to pay a $25 billion penalty in the Cambridge Analytica case.
EA is shutting down BioWare
Electronic Arts is closing the game studio BioWare.