Issue 43

23 October 2026

Hi there,

Two things we normally leave to the plumbing department made headlines this week: PHP’s request machinery and the certificates that tell a machine which server to trust. Both are everywhere, including in systems whose owners may have stopped thinking about them. Meanwhile, Singapore signed another AI agreement – a reminder that deployment is now as much about institutions and controls as it is about models.

Industry

1. Anthropic puts a Singapore team on the ground

Anthropic opened its fifth Asia-Pacific office in Singapore and signed an MOU with the Ministry of Digital Development and Information during Singapore International Cyber Week. The proposed work covers model evaluation, incident response, adoption research and AI skills. Anthropic says more than 1,500 GovTech engineers and technical staff have adopted Claude Code; the agreement is a framework for cooperation, not a government procurement contract. The more interesting test is what local assurance work and public-sector capability actually emerge from it.

2. OpenAI models are coming to Google’s cloud

OpenAI and Google Cloud plan to put OpenAI models and Codex workflows in Model Garden; general availability is planned in the coming weeks, rather than already switched on for every customer. OpenAI says Microsoft remains its primary cloud partner. For an enterprise already using Google’s governance and billing, another model family in the same environment makes comparisons easier – though migration still means testing tools, safety controls and the actual work, not merely comparing a model name.

3. Storefronts offer shopping agents proper tools

Commerce.com and Cloudflare are piloting WebMCP across a platform serving nearly 100,000 domains. Instead of guessing what a checkout button does from HTML, an agent can call structured browser-side tools to search products or build a cart. The proposed browser standard remains experimental and merchant opt-outs are part of the rollout. That last detail matters: giving agents a better interface is useful only if the shop controls what they may do and who owns the customer relationship.

CIO Corner: This week’s reads for leaders and decision-makers

Who makes the decision when the CIO carries the risk? Thoughtworks' survey of 3,200 CIOs describes AI budgets and deployment decisions spreading through the business while accountability remains with technology leadership. It argues for explicit decision rights, escalation paths and a division of labour between CIO, CTO, AI and finance leaders. In a large industrial group, an agent running in a plant or shared service needs a named process owner and a way to stop it – not merely a central policy PDF.

Better tools are not the same as changed work. Deloitte's State of AI in the Enterprise says 37% of surveyed organisations use AI with little or no change to existing processes, while 30% redesign key processes and 34% pursue deeper transformation. It gives a manufacturing example in which agents help balance product-development cost against time to market. The useful question for a CIO is where the work, hand-off and measurement changed, and what operators can do when the recommendation is wrong.

The deployment gap is a real operating problem. In OpenAI's account of forward-deployed engineering, John Deere's See & Spray technology provides a good illustration: the machine may reduce chemical use by up to 70%, but the benefit depends on farmers configuring it and adjusting practice. OpenAI describes building tailored advice around that workflow. A large company buying an agent should budget for field feedback, training and a repeatable support model; a benchmark does not tell you whether the people using the system can make it work.

Artificial Intelligence

4. Claude finds an unfamiliar DNA-repeat system

Anthropic’s biology team reports an early discovery from roughly 950 Claude agents: a reverse-transcriptase system in bacteriophages associated with an unusual array of DNA repeats. The agents searched for 21 hours and scientists followed up in the lab. Its function is still unknown; resemblance to some programmable systems is not proof of another CRISPR. The preprint is the start of a biological investigation, not a therapeutic result.

5. Thousands of agents comb a mouse-brain atlas

OpenAI, PerturbAI and Scripps Research divided an existing brain-cell dataset among GPT-Rosalind agents. The team says the agents analysed gene disruptions across millions of mouse cells in 32 minutes and linked patterns to research literature. They produced leads for scientists to test, not diagnoses or treatments for Parkinson’s or Alzheimer’s. The interesting instrument here is a searchable reasoning atlas that makes a huge experimental dataset less likely to disappear into a drawer.

6. Claude Duet tries being the colleague who comes to you

Anthropic opened a research preview of Claude Duet on 21 October: a proactive agent that watches connected apps, sends a morning brief and works on delegated tasks in its own cloud computer while you are away. It carries over a Claude account’s memory, skills and connectors, but asks before sending messages, making payments or taking other consequential actions. The interesting change is not another chat window; it is the judgement about what merits interruption and which actions need a human gate. For now, the waitlist is for US Pro and Max subscribers, not enterprise teams, and its background checks share the plan’s usage limits.

Infrastructure

7. OpenBSD 8.0 lands on its own terms

OpenBSD 8.0 arrived on 20 October, its 61st release. The release notes include arm64 hibernation, RISC-V vector support and a switch to LLVM for sparc64, while retiring loongson support. As ever, the long changelog is more useful to an administrator than a generic new-version headline: check the hardware and package changes before upgrading an actual firewall or server. And yes, the release has a song, called “The Simps on AI”.

8. Microsoft adds another layer to sovereign cloud

Microsoft extended its Sovereign Cloud programme across public, private and partner-operated environments. It frames sovereignty by workload: data residence, operational access, dependency and whether critical services can continue without a network connection. That is more useful than treating every system as if it needs the same data-centre arrangement. Customers still have to test the particular controls and failure modes they are buying; a continuum in a diagram is not an offline runbook.

Microsoft

9. The agent inside your network may be the insider

Microsoft calls enterprise agents “agentic insiders” because they can hold identities, use tools and act on systems without being compromised by an attacker. Its Project Perception approach combines signals from identity, endpoint, cloud and runtime with policies and guardian agents. The pitch is Microsoft’s, but the boundary is real: assign each agent an identity, narrow permissions and record the action before trusting a supervisor agent to catch an overreach.

Development

10. DNSimple makes the BEAM do less work per answer

DNSimple rewrote hot paths in dns_erlang using binary matching, a single encoding accumulator and cheaper compression keys. On its production-shaped benchmark, CPU per DNS query fell 12% and peak throughput rose 14%. The striking part is its measurement of work that did not help: isolated lowercase optimisations looked faster but barely moved whole-query performance. Profiling the real response path, not celebrating a microbenchmark, found the win.

11. A WAF that watches the answer as well as the request

Cloudflare introduced full-transaction detection and response rules for its WAF, making the request and the origin’s response part of one decision. Its first managed protections target PHP2Shell. A request that looks ambiguous may be clearer once the response leaks data or shows an exploit worked, and a response rule can stop that reply reaching the requester. Cloudflare says these capabilities are generally available, including on Free plans; they complement, rather than replace, fixing the vulnerable application.

Information Security

12. PHP’s emergency releases close two remote-code-execution paths

The PHP project released 8.5.12, 8.4.27, 8.3.36 and 8.2.35 on 21 October for CVE-2026-109618 and CVE-2026-109619. One involves out-of-memory cleanup of partially initialised request data; the other uses stale state after memory is freed. Both can permit unauthenticated code execution. Singapore’s CSA says exploitation attempts are widespread. Inventory PHP behind the website and in bundled components, then update the vendor build: restricting one HTTP method is not a complete fix.

13. Eight intermediate certificates expose the trust-store problem

Cloudflare reported compromised keys for eight eMudhra intermediates. A forged certificate from a trusted intermediate could let an attacker impersonate a site; the concern is which trust stores still accept those certificates, not a break in TLS encryption. Cloudflare says it has updated its services and issued new WARP and cloudflared releases, while some customers must check their own origin and application trust settings. One fleet can have several CA stores: OS images, language runtimes and devices do not all update together.

14. Finding the bug was only the start of fixing it

OpenAI’s Patch the Planet account describes AI-assisted discovery of one PHP flaw, independent findings by Wiz and coordination with maintainers and infrastructure providers ahead of release. PHP’s maintainers led the actual fix. The claim that defenders found the flaws before attackers is OpenAI’s assessment; it cannot rule out unseen exploitation. The difficult part for a global response remains distribution: backports, shared mitigations and the long tail of systems somebody must patch.

Coming up

17–20 November: Microsoft Ignite in San Francisco has a session catalogue for planning technical meetings and labs.

30 November–4 December: AWS re:Invent meets in Las Vegas; the programme is available to browse.

Cheers,
Julian

How this is made

Throughout the week I stumble across a mildly unreasonable number of interesting things, and I forward them instantly to the friend or colleague I think might care – sometimes to their delight, sometimes to their annoyance, and often with no context at all. Heartbeat is the attempt to do that a little better.

Every Friday a small agent I built, Honoka, looks through the places where those links tend to leak out: my private email, work email, Matrix, Mastodon, WhatsApp, Apple Messages, Signal, and the faint imprints on the platen of my Olympia typewriter (still not an API, tragically). It sorts, filters, groups and summarises the week, then hands me a draft.

Honoka is guided by a private corpus of things I have written over the last fifteen years, so it can get closer to how I sound in more-or-less official emails and public notes. I still take a pass by hand: remove things, change sentences, check links, argue with the judgement. Whether that is enough is, frankly, the experiment. Every issue has one item written entirely by hand. If you can reliably spot it, hit reply and judge.