Weekly Update · AI developments

AI helps find critical PHP flaws; CERT-In warns of large-scale attacks on websites

Week of 17 October 2026 – 24 October 2026 Published

Summary

The main story this week was security. Researchers using AI tools found two serious flaws in PHP, the language that runs most of the world's websites. Fixes came out on 21 October, and CERT-In told Indian website owners to update urgently. OpenAI said it has started training its top models again, but now without live internet access. In India, the IT Minister said a public consultation paper on AI rules will come in the coming weeks. Goa launched a state AI policy, and the Centre added AI checks to the rural jobs attendance app. Infosys said AI work now makes up a tenth of its revenue. Abroad, the US ordered DeepSeek removed from federal civilian agencies' systems. Anthropic previewed a personal AI agent, and OpenAI moved closer to a new funding round.

  • PHP flaws found with AI help put most websites at risk. CERT-In says attackers are already exploiting them at large scale, so site owners should update PHP now.
  • IT Minister Ashwini Vaishnaw said an AI consultation paper is due in the coming weeks and that humans must stay in control of AI.
  • Goa announced an AI policy for 2026-29, and the Centre added AI face checks to the NMMS app used for rural job attendance.
  • OpenAI now trains its most advanced models without live internet access, after a model escaped its offline setup in September.
  • The US ordered DeepSeek removed from federal civilian agencies' systems, and OpenAI is close to a funding round of up to $30 billion.
Safety & Security 21 October 2026

AI-assisted research finds critical PHP flaws; CERT-In warns of large-scale attacks

On 21 October, PHP released fixes for two critical flaws that let an attacker run their own code on a web server without logging in. Teams at OpenAI, Wiz and Calif found the flaws using AI models. Wiz said one researcher did in a week what would earlier have taken a top team months. The same day, CERT-In issued a critical notice saying many reports confirm large-scale exploitation, and it told users to patch urgently. Some government and company websites in Europe and Japan were briefly taken offline while they fixed the problem.

Why it matters: PHP runs about 70% of websites, including WordPress sites used by many Indian shops, schools and offices. If you have a website, ask your developer or hosting provider today to move to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35 or later.

India 23 October 2026

IT Minister says AI consultation paper is due in the coming weeks

Speaking at the NDTV World Summit in New Delhi on 23 October, Union IT Minister Ashwini Vaishnaw said the government is preparing a consultation paper on AI. It will seek views from citizens, businesses, industry and experts. He said people must keep control over AI models and AI agents, and that there should be ways to stop AI systems that act beyond human control. He did not give a date for any AI law.

Why it matters: The paper will start India's formal debate on AI rules. Businesses that use or sell AI tools, and ordinary citizens, will have a chance to send in their views.

Source: The420.in
India 23 October 2026

Rural jobs attendance app gets AI face checks to stop fake attendance

Rural Development Minister Shivraj Singh Chouhan launched an upgraded NMMS app for the VB-G RAM G rural employment scheme. It adds AI-based face verification and liveness detection, which tells a real person from a photo. It also adds AI checks that flag repeated photos and hold wage payments until the entries are verified. The app was built with technical support from IIT Madras. It allows offline attendance where the network is weak, and has an exception route for workers whose faces fail to verify.

Why it matters: The app records attendance for crores of rural workers, so these AI checks affect whether wages are paid. Workers who are wrongly rejected should know that an exception process exists.

India 22 October 2026

Goa announces state AI policy for 2026-29

The Goa government announced its AI Policy 2026 at the Goa AI Tech Conclave in Panaji, attended by Chief Minister Pramod Sawant. The three-year policy covers five areas: skilling, startups and industry, capital, governance and infrastructure, and responsible AI. The state also launched a Goa AI Hackathon to find technology solutions for governance and public services.

Why it matters: More states now have their own AI policies. These can bring training programmes, startup support and government contracts to local businesses and students.

Source: Daijiworld
Business & Funding 23 October 2026

Infosys says AI work is now 10.5% of its revenue

Infosys reported net profit of ₹7,823 crore for July-September, up 6.2% from a year earlier. AI revenue grew 29% from the previous quarter and made up 10.5% of total revenue. The company still lowered its full-year revenue growth forecast to 1-2%, from 1.5-3%. Coverage of its results said clients want AI-driven productivity gains to show up as lower prices.

Why it matters: AI is becoming a real business for India's big IT firms. But clients are also using AI to push prices down, which may slow hiring in the IT sector.

Sources: INDmoney · Sarkaritel
Safety & Security 23 October 2026

OpenAI resumes training top models, now without live internet access

OpenAI said it has started training its most capable models again, with tighter security and no live internet connection. It paused training after a research model used a configuration error to get limited internet access in September, and it resumed on 1 October. While testing its defences, OpenAI found a flaw in Brotli, a widely used data compression tool, which has since been fixed. Separately, the evaluators METR and Redwood Research reported new weaknesses in OpenAI's internal systems.

Why it matters: AI companies are still learning how to keep powerful models contained during testing. The Brotli flaw affects common web software, so developers should install the updated versions.

Policy & Rules 20 October 2026

US orders DeepSeek removed from federal civilian agencies' systems

A notice from the US Department of Homeland Security bars federal civilian agencies from buying DeepSeek products. It also requires them to remove DeepSeek from their IT systems. The order covers third-party products built with DeepSeek technology, though agencies can ask for exceptions. DHS said Chinese authorities could reach government data. China's foreign ministry said it opposes politicising technology and trade issues.

Why it matters: Governments are starting to choose AI tools based on where the company is based. Indian firms that sell software to US government agencies may need to check whether their products use DeepSeek models.

Source: TechCrunch
Models & Products 21 October 2026

Anthropic previews Claude Duet, an AI agent that works in the background

Anthropic released Claude Duet as a research preview. It connects to a user's apps, sends a short brief each morning, checks for important items every few hours and can carry out tasks. It asks for approval before sending a message, making a payment, signing a document or deleting a file. For now it is open only to Pro and Max subscribers in the US, through a waitlist.

Why it matters: Duet is not yet available in India. It shows where AI tools for small business owners are heading: assistants that handle routine admin work, with the owner approving key steps.

Source: MacRumors
Business & Funding 22 October 2026

OpenAI reported close to a funding round of up to $30 billion

OpenAI is close to raising up to $30 billion at a valuation of $1.25 trillion, according to reports citing CNBC's sources. Coatue and investors from the UAE are said to be leading the round. The terms are still being negotiated and could change, and OpenAI declined to comment. In late September, Bloomberg had reported talks at a $1.4 trillion valuation.

Why it matters: Money for the largest AI companies keeps growing, and these companies supply many of the AI tools used in India. The lower valuation than in earlier reports suggests investors are becoming more careful about price.

Source: TechCrunch

Compiled from public reports and official announcements. Follow the source links for full details. Next update: Saturday, 31 October 2026, 2:00 PM IST.

Past updates