THE SHORT VERSION
● Claude Duet — proactive agent on Opus 5.5, free on Pro and Max, US waitlist
● php2shell — six countries pulled government sites offline; 22.6M systems exposed
● OpenAI on Google Cloud — Model Garden and Marketplace, payable with GCP commitments
● HeyGen Voice Turbo — #1 TTS at 1,202 Elo and $4/M chars against Eleven v4 at $80
The three that matter
1. Claude Duet opens to US Pro and Max
Anthropic launched a research preview of Claude Duet on 21 October: a separate app running Claude Opus 5.5 on its own cloud VM with a browser, so it keeps working while your devices are off. It sends a morning brief, monitors connected apps and messages you only when something needs attention. Included in Pro and Max at no extra cost, sharing the same usage limits. US only, waitlist, standalone iOS and Android apps plus claude.ai, with over 6,000 Claude Marketplace connectors. It asks before sending, paying, signing or deleting — and trading securities and moving money between accounts are blocked even with your approval, the most informative detail in the launch. Full breakdown: Claude Duet explained.
2. php2shell took government websites offline across Europe
The Dutch NCSC's own site, DigiD, MijnOverheid, the House of Representatives, the Port of Rotterdam and several hospitals went dark. Finland's Valtori pulled government public network services, France's Interior Ministry suspended local administration sites, Denmark's Kombit shut the national school communication platform, Germany's ITZBund took sites down, and in the UK the Metropolitan Police, Edinburgh and Oxford councils went offline. CVE-2026-109618 and CVE-2026-109619, both 9.2, patched Wednesday around 3pm UK time in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Unit 42 counts more than 22.6 million exposed internet-facing systems; Cloudflare CTO Dane Knecht called the firm's emergency firewall rules "STOPGAP only." Full story: php2shell blackouts.
3. OpenAI models are coming to Google Cloud
OpenAI frontier models and Codex will be sold through Google Cloud's Model Garden and Marketplace, with eligible companies able to pay using existing Google Cloud spending commitments. GA in the coming weeks. That commitment detail changes enterprise model selection, because it removes a procurement obstacle rather than a technical one.
Products and models
- HeyGen Voice Turbo took #1 on Artificial Analysis' Controlled Voice leaderboard at 1,202 Elo and $4.00 per million characters, against HeyGen Voice at #2 ($30) and Eleven v4 at #5 ($80, 1,156 Elo). Live as
heygen-voice-1-turbo. Note the prices are Artificial Analysis conversions and ranks 1–3 are statistically grouped
- Flint, Recursive's first model, built by an automated AI research system: 39.8B total parameters, ~2.5B active per token, over 125 tokens/sec on a MacBook Pro and 150 on RTX Spark, per Richard Socher. Checkpoint out for local coding agents
- UseIt Studio, a design agent producing editable manufacturing files with dimensions, bleed and dielines for packaging, stickers and cards
- Needle, outbound sales across LinkedIn, Instagram and email driven from Claude Code, Codex and Cursor via MCP and REST, charging per connected sender account rather than per lead
- GM OnStar AI, the next-generation in-vehicle assistant, expected to debut in the 2027 Cadillac Lyriq
Security and AI
OpenAI says GPT-5.6 Sol identified a critical flaw in the php2shell pair, with Wiz independently finding both, and is calling the gap between AI-assisted discovery and public disclosure the Defender's Window — a framing php2shell tested badly, since the window closed a day early when the flaws leaked ahead of embargo.
People and policy
- Two Google DeepMind researchers resigned. Research engineer Sofia Liguori this week and researcher Andreas Kirsch earlier in October, both over Google's visibility into and control over Pentagon use of its AI. Google says public-sector contracts go through compliance reviews
- Dario Amodei defended Anthropic's safety record against Encode AI's Nathan Calvin, citing a four-month delay to the Mythos model as absorbed commercial cost and acknowledging the company mishandled some recent issues
- Design It For Us, built on feedback from over 700 members across 40 states, wants Congress to pass AI protections by end of 2027, including independent testing of large systems and liability for AI-caused harm
Partnerships and research
- Mistral and NVIDIA will connect Mistral models to NVIDIA simulation and computing tools for engineering and chip design, plus public datasets and benchmarks for agents on computer-aided engineering tasks. No figures disclosed
- Perplexity's JOLT trains one model in both teacher and student roles, the teacher seeing verified solutions and optimised to give feedback the student can use. Gains reported in math, coding and agent tasks, without figures
What to actually do
- Patch PHP today and restart the service — the second CVE depends on state persisting inside a worker
- Join the Duet waitlist if you already pay for Pro or Max. Do not upgrade tier for a research preview that admits it misjudges urgency
- Re-test your TTS vendor if narration is a real line item. A 20x price gap at statistically equivalent quality is worth an afternoon
- Ask finance about your Google Cloud commitment before the next model decision
Sources
The Neuron, 22 October · Claude Duet · PHP.net advisory · Artificial Analysis