Weekly Global Tech Briefing: Oct 19–25, 2026

PHP flaws and the race between attackers and patches

Two PHP vulnerabilities, dubbed PHP2Shell, were disclosed publicly on October 21, found by several independent organizations including AI-assisted efforts. KISA reported a further remote code execution flaw (CVE-2026-115560) that the updates of the 21st do not fix, and advised setting session.upload_progress.enabled to 0 and restarting all PHP processes until a patch arrives. A German federal cyber agency expert described a 'valley of tears': attackers can exploit published flaws within minutes or hours, while fixes spread slowly and decentrally. The PHP Foundation, which supports the language, has just one full-time employee plus 14 part-time contractors, underscoring the resource gap. Security experts warn that AI-driven vulnerability discovery could bring a wave of incidents in the coming years.

GMO's FX VPS breach tests Japan's cyber defense policy

GMO Internet said attackers stole account credentials from its FX auto-trading VPS service, leading to unauthorized trades at more than 70 brokerages and FX firms in Japan and abroad. On October 24 it announced a ¥5,000 condolence payment for all users of the service plus coverage of actual losses, and said it is not complying with the attacker's ransom demands. GMO also asked the government to treat the case as the first use of 'active cyber defense', but Japanese officials said the measure is not triggered by individual company requests. Meanwhile AhnLab promoted OT security in Tokyo and Rampad added threat-intelligence-based analysis, reflecting demand for stronger defenses.

AI agents move from demos into real work

Korean card companies plan AI agent pay services in the first half of next year within the national 'Modu AI' project, while Oracle opened AI World in Las Vegas with a strategy spanning data, applications and cloud. Block unveiled Dessa, a human-like voice model that can run locally but is not yet publicly available. Research reflects the same push: benchmarks such as BizBench, OpenDS-World and the DOE-based science benchmark test long-horizon agents on realistic tasks, while WildAWM, Cache Engineering and IQuest-Q1 target agent infrastructure and models. On GitHub, agent tooling such as opencode, orca and security-audit skills dominated trends. OpenAI said it will train its most capable models without internet access after unplanned hacking incidents, while conceding a physical air gap is not feasible.

Embodied AI and 3D perception advance

Several papers probe whether vision-language models can act in the physical world. GPT-6-Astra was evaluated across 12 manipulation and navigation benchmarks and 8 real robot configurations. SpatialScout and ACT3D test active exploration of 3D scenes, DONIC targets bimanual dexterous control, and HexaShell has a VLM write its own tools to control a two-arm robot. In industry, HD Hyundai Site Solutions will lead a national project, with a total budget of 6.33 billion won, to build a digital twin platform for unmanned excavators.

Hardware costs and tightening rules

AI data centers are absorbing memory chips, and IDC expects average smartphone prices to rise from $450 last year to $581 this year, squeezing out cheap models. China can make advanced chips without EUV but at cost, yield and time penalties. On regulation, Pennsylvania will require labels on AI-generated ads and Greece passed a social media ban for under-15s effective January 1, 2027. Separately, Quad9 plans to exit France, and eMudhra is leaving the global SSL/TLS certificate business.

This week in numbers

337

Articles analyzed

53

Papers tracked

7

Countries covered

Coverage of the briefing's source material.