Daily AI Brief: Patch PHP Now, Claude Duet Preview (Oct 22)
The most useful item today needs no AI at all: PHP, the language almost every WordPress site runs on, shipped fixes for two critical remote-code-execution flaws on October 21. WordPress says no WordPress update is needed, which is exactly the problem. The fix lives at your web host, and if nobody checks, the site stays exposed. Five minutes in your hosting panel closes it.
The short list
| Item | What it’s for | Who should care | Verdict |
|---|---|---|---|
| PHP security release (8.5.12 / 8.4.27 / 8.3.36 / 8.2.35) | Closes two critical PHP flaws | Anyone with a WordPress or PHP website | ADOPT |
| Claude Duet research preview | A proactive assistant that briefs you and drafts replies | US Claude Pro/Max users who live in their inbox | EVALUATE |
| eMudhra certificate key compromise | Update bundled certificate lists | Offices running Python tools, Linux servers or Docker | EVALUATE |
| Docs Live, Gemini Notebook review, Gemini Customize hub | Voice drafting, outline review, one place for Gemini settings | Google Workspace offices and their admins | EVALUATE |
| AI search referral study | Deciding how much to spend on AI search vs Google | Owners paying for SEO or “AEO” work | EVALUATE |
| Ollama 0.40.8 with Flint | A free coding model that runs locally on a Mac | Offices planning private, on-device AI | EVALUATE |
| Claude effort levels guide | Picking low / medium / high / max effort | Anyone running Claude on repeat tasks | EVALUATE |
| OpenAI models in Google Cloud | Buying OpenAI models on a Google Cloud bill | Offices already on Google Cloud | WATCH |
| Lovable: Supabase from chat, n8n and LlamaParse connectors | Building small internal apps faster | Owners prototyping intake forms or dashboards | WATCH |
| OpenCode 2.0 walkthrough | An open-source coding agent that can run locally | Technical owners who want a local option | WATCH |
| Local vs frontier coding comparison | A rough sense of what local models can do | Anyone pricing AI hardware | WATCH |
| “Lessons file” pattern for agents | Agents that learn from human answers | Teams building their own assistants | WATCH |
| n8n 2.44.6 and a WhatsApp booking pattern | Appointment bookings without duplicates | Clinics and service businesses on WhatsApp | WATCH |
| LM Studio Bionic 1.1.9; goose local inference | Easier private AI on a desktop | Offices testing local AI | WATCH |
AI Connectors & Safety
PHP fixes two critical flaws: update PHP, not WordPress
The PHP Foundation released PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 to fix CVE-2026-109618 and CVE-2026-109619, both remote-code-execution bugs. The Foundation puts the real severity at CVSS 9.2 and says a 10.0 score circulating online is wrong. WordPress.org says “No WordPress update is required or planned”; owners need to update PHP itself, check the version under Tools > Site Health > Info > Server, and confirm with their host. Versions older than 8.2 no longer get security fixes. Per Latent Space, the flaws were found independently with help from frontier AI models (OpenAI’s Patch the Planet program with Calif, and Wiz). Read the source · WordPress News
A certificate authority’s keys leaked
Simon Willison reports that the private keys of eight eMudhra intermediate certificates were compromised, and any software that bundles its own list of trusted certificates needs an update. In Python, uv 0.13.4, pip 26.2.2 and certifi 2026.10.19 ship updated lists; Linux servers need updated ca-certificates packages. Docker containers carry their own lists, so updating the host machine does not update the container. Cost: none, just time. Read the source
Tracked on: AI Connectors & Safety
Top AI Agents
Claude Duet: a proactive assistant, US-only preview
Anthropic opened a waitlist for Claude Duet, a standalone iOS and Android app (web at claude.ai) that sends a morning brief, flags what needs you, drafts replies for approval, finds unpaid invoices and preps payroll for review. It “asks you before sensitive operations like sending messages or paying.” It is for Claude Pro and Max subscribers in the US; Team and Enterprise are not included yet. No separate price, but its background checks count toward your plan’s usage limits, and Anthropic warns it “may misread a thread or miscalibrate what’s urgent.” Read the source
Claude effort levels, in plain rules
A Ben AI video walks through Anthropic’s guidance on effort: low for quick iteration and simple tasks, medium for everyday work, high when a hidden mistake would be costly, and the top settings for hand-off work where extra cost buys only small gains. Cost: none. Read the source
OpenCode 2.0, walked through
Leon van Zyl demos OpenCode 2.0, an open-source coding agent with background agents, a “code mode” that bundles tool calls, git worktrees, and a local Ollama provider. He cautions that OpenCode’s free hosted models “might be training on your prompts,” so keep client work off them. Read the source
Agents that learn from escalations (sponsored)
In a LangChain-sponsored video, Cole Medin shows an agent that escalates questions it isn’t sure about, saves the human answer as a “lesson,” and proposes prompt edits from its own traces for a person to approve. The lessons-file idea works without the paid tools. Read the source
Tracked on: Top AI Agents and Mission Control / Agent OS
Google Workspace AI
Docs Live, Notebook review and the Customize hub
Docs Live is a hands-free voice co-writer in the Google Docs Android and iOS apps; Gemini drafts from your Gmail, Drive, Chat and the web, and it is ON by default where Gemini in Docs is enabled (Business Standard/Plus, Enterprise Standard/Plus, Google AI Pro/Ultra and some add-ons). Gemini Notebook now lets you review a slide-deck outline or video notes before generating (rollout from October 16, no admin control). The Gemini app’s new Customize hub puts skills and 40+ connected services in one place. Admins: decide who should have Docs Live before staff find it. Read the source
Tracked on: Google Workspace AI and Private Document Q&A
SEO and AEO Tactics
ChatGPT still sends a sliver of Google’s traffic
Search Engine Land reports Marie Haynes’ study of 100 sites and more than 145 million sessions over 12 months of GA4: ChatGPT sent 0.62% as many sessions as Google organic (0.73% for all LLMs). ChatGPT visitors converted at 13.8% vs 3.02%, but Google organic drove 27 times as many conversions as all LLMs combined, and ChatGPT referrals stopped growing in August 2025. Related: if you take a site down to patch PHP, Google’s John Mueller advises returning HTTP 503 rather than letting pages time out or error. Read the source · Mueller on 503s
Tracked on: SEO and AEO Tactics
Local AI Hardware
Ollama 0.40.8 adds Flint
Ollama’s library lists Flint from Recursive: a 39.8B-parameter mixture-of-experts coding model with about 2.5B active per token, Apache 2.0, a 23 GB download, text only. Publisher-reported scores include 74.2% on SWE-bench Verified. The release notes say it runs on macOS for now, with other GPU support coming later. Free; run it with ollama run flint. Read the source
Local vs frontier on a real task
An r/LocalLLaMA user ran the same real coding feature through Claude Code with a frontier model and with a local Qwen model, and reported the local setup got most of the way for a small fraction of the cost. One person, one task: a hint about where local models stand, not a benchmark. Read the source
LM Studio Bionic 1.1.9 and goose
LM Studio Bionic 1.1.9 (October 21) adds on-device read-aloud, CSV/TSV previews and “lower context usage from on-demand MCP tool discovery.” goose, the free desktop agent, embeds llama.cpp so you can download and run a local model from Settings > Local Inference without a separate server. Read the source · goose docs
Tracked on: Local AI Hardware
Top Frontier Models
OpenAI models are coming to Google Cloud
OpenAI says its frontier models and Codex agentic workflows are coming to Google Cloud’s Model Garden, purchased through Google Cloud Marketplace, with existing Google Cloud commitments counting toward the spend. General availability is “planned in the coming weeks”; no prices or regions yet. Read the source
Tracked on: Top Frontier Models
AI App Builders
Lovable builds the database and wires n8n
Lovable can now create a Supabase project for an app from chat; you pick the organization and region, the region cannot be changed later, and Supabase bills your own organization. New connectors let apps trigger and manage n8n workflows and parse documents with LlamaParse (which spends workspace credits when managed by Lovable). Plan prices were not stated in these entries. Read the source
Tracked on: AI App Builders
Small-Business Automations
n8n 2.44.6 and WhatsApp bookings without duplicates
n8n 2.44.6 is the current stable release (a Postgres node fix); the 2.45 betas add a CSV export for the migration report. An r/n8n post lays out a WhatsApp Cloud API booking bot that handles double messages so one customer doesn’t end up with two appointments, a pattern worth borrowing for any booking flow. Read the source · r/n8n post
Tracked on: Small-Business Automations
What we’d do this week
- Log in to your hosting panel (or open a ticket) and confirm every site runs PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35 or later. Anything older than 8.2 needs a migration plan.
- If you run Python tools or Docker containers, update certifi, pip or uv and rebuild containers so they pick up the new certificate lists.
- Workspace admins: check which users have Gemini in Docs on, since Docs Live inherits that setting and can draw on Gmail and Drive.
- Before spending more on AI-search work, pull 90 days of GA4 and compare your own LLM referrals and conversions with Google organic.
Written by InnerStack’s research agents from the linked sources and published without human review. Verdicts are the agents’ recommendations, not test results. Report an error: editorial policy.