This is the news from Thursday 22 October. Read the latest news
Daily news
PHP2Shell fixes, WordPress 7.2 Beta 1 and ChatGPT locked chats
Today in 30 seconds
- PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix two critical PHP2Shell flaws
- Google’s John Mueller: use a 503 if PHP2Shell takes your site offline
- WordPress 7.2 Beta 1 is out, and suggestion mode slips to 7.3
- Google rankings swing again on 20 and 21 October
- Google lists its AI control in the “what you share” Search doc
- GitHub package firewall checks npm installs for malware
- OpenAI models and Codex are coming to Google Cloud
- Gemini gets a business hub that links to Shopify, Wix and Xero
- ChatGPT now lets you lock chats with a PIN or Face ID
- Mistral Voxtral 3 brings cheap transcription and a voice agent kit
- iPhone Duo reviews are in, and Apple Pencil support comes early
Good morning. Today is a PHP day. Two critical PHP flaws went public overnight, attacks have started, and almost every WordPress site runs on PHP. Fix that first. After that, the news gets friendlier: WordPress 7.2 Beta 1, ChatGPT chats you can lock, and the first iPhone Duo reviews.
PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix two critical PHP2Shell flaws
PHP released fixes on 21 October for two flaws that let an attacker run code on a server without logging in. CVE-2026-109618 and CVE-2026-109619, nicknamed “PHP2Shell”, are both rated 9.2. The fixed versions are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
The flaws are in PHP itself, so updating WordPress or your plugins does not help. PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed are all affected, and mod_php is the most at risk. Details leaked before the release. Cloudflare says it saw attack traffic, and it added protection for all plans, Free included, about nine hours before disclosure. OpenAI says its GPT-5.6 Sol model helped find one of the flaws.
Why it matters This hits almost every WordPress, WooCommerce and Laravel site. Update PHP today. On shared or managed hosting, ask your host if the 21 October release is in. On your own server, install the new packages and restart every PHP process, because a reload is not enough for Apache mod_php. PHP 8.1 and older get no fix from PHP, so plan the move to 8.3 or newer now.
If I had one job today, this would be it. In WordPress, go to Tools, Site Health, Info, Server to see your PHP version. If your site sits behind Cloudflare, my Cloudflare 101 guide shows how to turn on the free plan. It buys you time, but it does not replace the update.
Google’s John Mueller: use a 503 if PHP2Shell takes your site offline
John Mueller from Google shared advice on 21 October for site owners who take PHP sites down to patch them. Return an HTTP 503 status, he said, instead of letting pages time out or show a 404 or 500 error.
He added that you can do this outside PHP, for example with your CDN or by pointing DNS somewhere else.
Why it matters A 503 tells Google “come back later”. A 404 or 500 for a day can make pages drop out of search. If you go offline, serve a 503 and bring the site back as soon as PHP is patched.
WordPress 7.2 Beta 1 is out, and suggestion mode slips to 7.3
WordPress 7.2 Beta 1 arrived on 20 October. Beta 2 is due on 27 October and the final release on 8 December. New this time: images can be resized, compressed and converted in the browser before they upload.
You also get text shadows, responsive controls for more blocks, a new “On This Day” dashboard widget and the Secrets API for developers. Two features missed the cut again. Suggestion mode for Notes and the Table of Contents block move to WordPress 7.3. The Secrets API settings screen is planned for 7.3 too.
Why it matters Image compression before upload means smaller files without an extra plugin. Test on a staging site or WordPress Playground, never on your live site. My guide to image optimisation covers the rest of the speed story.
Google rankings swing again on 20 and 21 October
SEOs reported big ranking swings and more forum chatter on 20 and 21 October. Google has not confirmed an update. Barry Schwartz expects a core update soon, after the September spam update ended on 8 October.
Reports are mixed. Some sites lost Search and Discover traffic, then got it back hours later. Others saw better positions but fewer clicks. Glenn Gabe says rank tracking tools show the drops on the wrong dates.
Why it matters A tool chart is not your traffic. Check Search Console and your analytics first, and wait a few days before you change anything.
Google lists its AI control in the “what you share” Search doc
Google updated its “Control what you share with Google Search” help page on 21 October. It now lists the options that already exist: the robots meta tag, data-nosnippet, the X-Robots-Tag header and the Search generative AI control.
Google says the change keeps the page current and makes clear it covers Google Search only. No new controls were added.
Why it matters Everything you can use to limit snippets and AI answers is now on one page. Use data-nosnippet on text you never want quoted, like prices that change daily. I think it is the most overlooked tag of the lot. My guide on how AI search finds your site explains the other side.
GitHub package firewall checks npm installs for malware
GitHub launched its package firewall in public preview on 20 October. It sits between your build machines and the npm registry. It checks each package and download for malware before it reaches Actions runners or coding agents.
Admins can set a cooldown for brand new versions, block packages with known malware or flaws, and catch packages that lose their signed build proof. It is for GitHub Enterprise Cloud, supports npm only, and is free during the preview.
Why it matters Npm worms keep stealing tokens during installs. I think a cooldown of a few days on new versions stops most of them before they reach you. Not on Enterprise? You can set a minimum release age in your package manager.
OpenAI models and Codex are coming to Google Cloud
OpenAI and Google Cloud announced on 21 October that OpenAI’s frontier models and Codex will come to Google Cloud’s Model Garden. General availability is planned “in the coming weeks”. OpenAI models will also come “soon” to Google Antigravity and the Gemini Agent.
Customers can buy the models through the Google Cloud Marketplace and count it against their Google Cloud spend. No prices or model names were given.
Why it matters If your company runs on Google Cloud, you could use GPT models without a new contract or a new bill.
Gemini gets a business hub that links to Shopify, Wix and Xero
Google added a business landing page to the Gemini app on 20 October. It is a home for building your brand, checking your finances and reading customer insights. It starts rolling out globally to all Gemini app users in the coming days.
It connects to Google Business Profile, Google Ads and Workspace, plus Shopify, Wix, Canva, Adobe, Dropbox, Zoho and Xero. Upload your logo, fonts and colours, and Gemini keeps new images on brand.
Why it matters Small shop owners get a free marketing helper that already knows their brand. I’d set up your brand kit once, then check the numbers it gives you against your real books.
ChatGPT now lets you lock chats with a PIN or Face ID
OpenAI started rolling out Locked Chats on 20 October, for Free, Go, Plus, Pro, Business, Enterprise and Edu users. You lock a chat with a four-digit PIN, or Face ID or Touch ID on supported devices. Locked chats move to their own section and leave search results.
They also get their own memory, so details don’t leak into your normal chats. But this is not end-to-end encryption, and it doesn’t change how long OpenAI keeps your data. Reset the PIN and every locked chat is deleted for good.
Why it matters Handy if you share a laptop or hand your phone to a client. Write your PIN down somewhere safe, because forgetting it costs you every locked chat.
Mistral Voxtral 3 brings cheap transcription and a voice agent kit
Mistral launched Voxtral 3, a family of speech models, on 21 October. The transcription models cover more than 50 languages, from US$0.0035 a minute. A real-time version answers in under half a second, and new text-to-speech costs US$13 per million characters.
There is also a voice agent SDK built on LiveKit, from US$0.04 a minute. It listens, thinks, calls tools and speaks. Mistral says its transcription beats Whisper and Gemini on its own tests.
Why it matters A phone or chat agent for a small business keeps getting cheaper. I’d try it on a booking or FAQ flow first, and keep a human one tap away.
iPhone Duo reviews are in, and Apple Pencil support comes early
The first iPhone Duo reviews landed on 21 October, two days before launch. Engadget gave Apple’s first foldable 8.8 out of 10. It praised the matte inner screen that hides the crease, the battery life and the IP68 rating. The downsides are the 254 g weight, the US$1,999 starting price and apps that don’t fit the big screen yet.
9to5Mac reports that Apple Pencil support comes with iOS 27.2, expected around 26 October. Only the USB-C Apple Pencil works.
Why it matters “apps not optimised for the big screen” will soon be “websites not optimised” too. Test your site at 7.6 inches in a near-square shape. My guide to touch-friendly buttons and menus helps with the tapping part.
Quick hits
- Google Merchant Center now says fast shipping in Australia means 3 days or less. Search Engine Roundtable
- ChatGPT Ads will auto-rewrite your ad copy from 30 October unless you opt out. Search Engine Roundtable
- Safari 27 blocks identity firms that turn email addresses into cross-site tracking IDs. WebKit
- WhatsApp help pages hid instructions for AI bots, which Meta calls a bug now fixed. Redact
- Gemini Personal Intelligence is rolling out on Android Auto, with Gmail, Calendar and Maps. 9to5Google
- Dependabot now supports npm 12, pnpm 11 and 12, and Bun 1.4. GitHub Changelog
- DeepSeek open-sourced DeepInfer, the engine behind its own service, under Apache 2.0. GitHub
- Shopify stores: all apps tied to the fake checkout redirects are now fixed or removed. Test your checkout anyway. Roman Zipp
- Nordwand Mono is a free, compact coding font drawn entirely in Python code. GitHub
You're all caught up
That's today's web, tech and SEO news. The next edition lands tomorrow morning, around 3 am Melbourne time.That was the news from Thursday 22 October. A newer edition is waiting for you.
Read the latest news → ← Wednesday's news Every edition
Get the news by email
One short email every morning. Free, and you can unsubscribe any time.
That’s you caught up. Not sure if your host has patched PHP, or which PHP version your site can handle? My site updates service takes care of it. And if the ranking swings hit your traffic, my SEO service can find out why. See you tomorrow.
Opens in a new tab
Comments
No comments yet. Questions, fixes and better ways are all welcome.