Business
PHP2Shell: Critical PHP vulnerabilities patched, update now!
The PHP development team has released emergency security updates to fix PHP2Shell, two critical vulnerabilities (CVE-2026-109618 and CVE-2026-109619) that could let attackers execute code remotely on web servers without logging in. The fixes are in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, and the team is strongly urging all PHP users to update immediately.
“These findings rank among the most severe vulnerabilities discovered in PHP, and arguably in software history. The underlying flaws had been present for decades, but demonstrating their exploitability required an exceptionally complex chain of steps, at the edge of what human researchers could practically achieve. Frontier AI models substantially reduced that barrier, turning a longstanding flaw into an exploit,” Wiz researchers explained.
Who is affected?
Every PHP installation that serves web requests is affected, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. Setups using mod_php face the greatest danger. A working exploit has already shown that a single unauthenticated request can trigger the attack before any application code runs.
“The PHP situation will lead to a mass of incidents – it’s one of the biggest vulns in years,” noted security researcher Kevin Beaumont.
The vulnerabilities
CVE-2026-109618 – RCE via OOM corruption: out-of-memory handling can interrupt PHP while internal request data is only partially initialized. Request cleanup may then treat the invalid data as valid.
CVE-2026-109619 – RCE via stale global state: request-owned internal state can survive after its backing memory has been freed. A later request handled by the same worker may use that stale state before normal initialization resets it.
The UK’s National Cyber Security Centre (NCSC) is urging organizations to consider taking offline any system that can’t be fixed right away.
“So many embedded installations out there that will never be patched. Too many forgotten, unmaintained apps. There will be a long tail for this one,” commented computer forensics expert Hal Pomeranz.
How can you fix CVE-2026-109618 and CVE-2026-109619?
Update to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35. Downloads are available here.
Linux distributions and long-term support (LTS) vendors got the patches ahead of the public release, so admins should check with their vendor for updated packages.
The PHP project no longer supports PHP 8.1 and earlier versions. Some distributions and LTS vendors offer backported fixes, so users on these versions should contact their vendor or upgrade to a supported release.
Anyone who relies on rpms.remirepo.net, a volunteer-maintained repository, is advised to switch to distribution packages or build PHP from source so they can patch immediately. The repository will not have updates available today.
Because the vulnerabilities are so severe, the PHP security team has also released minimal source backports for PHP 7.4, 8.0 and 8.1. These are meant for people who build from source or who don’t have an LTS vendor.
Business
Why is your power bill so high? What to check and where to find help
Higher electric bills are reaching into Americans’ grocery budgets, according to a Consumer Reports survey released Wednesday, as North Carolina regulators consider Duke Energy’s proposed rate increases.
About 1 in 5 Americans said they cut back on groceries, switched to cheaper food or considered those changes to pay an electricity bill. Among people who had lived in the same home for at least three years, 81% said their electricity bills had increased during that time.
“You can’t control the rising costs yourself,” said Sara Enright, senior director of safety and energy at Consumer Reports.
The nationally representative survey of 2,003 U.S. adults highlights the pressure on households already trying to conserve. Understanding which charges are growing can help identify potential savings, while a recently launched Triangle partnership aims to make upgrades and rebates easier to navigate.
Breaking down your power bill
According to Consumer Reports, 38% of Americans who read their electric bills said they were difficult to understand. For North Carolina customers, here’s what to check:
Electricity use: Kilowatt-hours (kWh) measure consumption. Compare average daily usage with the same period last year, accounting for weather and changes in household routines. Daily averages also account for billing periods with different numbers of days.
Fuel costs: The fuel rider adjusts what customers pay for fuel and purchased electricity. It can rise or fall separately from a general rate increase. Lawmakers changed how some of those costs are divided among customers, shifting a larger share toward households.
Other adjustments: Duke’s “Summary of Rider Adjustments” combines charges and credits for costs such as energy efficiency programs and certain clean energy purchases. A separate storm recovery charge repays bonds used to finance repairs after major storms.
Errors or unfamiliar services: Check charges for equipment on your property, too. I found an erroneous $18.80 monthly charge on my own Duke bill for a streetlight that hadn’t worked in years. After I contacted Duke, the company removed the charge and issued a refund.
Fuel charges deserve attention because customers bear those cost changes, while Duke says it earns no profit on fuel. WRAL’s reporting on a court challenge to Duke’s fuel charges explains how a 2025 law also expanded the utility’s ability to recover past expenses.
Duke says customers can use several tools to understand changes before the next bill arrives:
Bill Insights: Available in Duke’s mobile app, the AI-powered feature provides a personalized explanation of monthly costs, including weather’s impact and how usage compares over time.
Usage Alerts: Midcycle emails show electricity use so far and project the bill total, giving customers time to adjust.
Daily and hourly tracking: Customers can look for spikes in consumption and compare billing periods through Duke’s website or app.
For explanations of individual bill sections, Duke also offers a Reading Your Bill guide.
A new Triangle resource
Electrify the Triangle, launched this month, brings together local governments, community organizations and energy experts, according to Megan Anderson, Raleigh’s sustainability officer. It builds on Solarize the Triangle, which used group purchasing to reduce solar installation costs.
The expanded effort includes weatherization and other clean energy improvements. Energy navigators will help residents discuss their bills, identify incentives and weigh options for their homes. The partnership also plans to help contractors handle rebate paperwork so those savings can reach customers.
“There’s a lot for them to understand. The rules change all the time,” Anderson said. “We’re trying to break down those barriers and actually become the person that will do all that work for them, so it’s easier for them to pass along those savings to residents.”
Anderson said the program aims to help residents planning improvements as well as those who need to replace broken equipment immediately.
Where to find help in North Carolina
Resources vary depending on whether you need to pay a bill now or make improvements that could lower future costs.
Find rebates and incentives: NC State University’s N.C. Clean Energy Technology Center maintains DSIRE, a searchable database of renewable energy and energy efficiency programs. Filter for North Carolina, then check individual listings for eligibility, participating utilities and current availability.
Get help with home upgrades: Energy Saver North Carolina helps qualifying homeowners and renters cover improvements such as insulation and heating equipment.
Ask about bill assistance: Contact your county Department of Social Services about the Low Income Energy Assistance Program, which provides a one-time annual payment toward eligible households’ heating expenses, or the Crisis Intervention Program for households facing a heating- or cooling-related crisis.
Contact your utility: Ask about payment arrangements and assistance funds, including Duke Energy’s Share the Light Fund. Eligibility and available funding vary.
Consumer Reports released Wednesday’s survey alongside Power Smarter, an initiative collecting utility bills to study prices and support its advocacy for lower costs. Its Bill Decoder project collects utility bills to build a national data set the organization says it plans to use to track prices, investigate what’s driving increases and advocate for fairer rates. Participants receive links to savings and assistance resources.
Consumer Reports is also campaigning against Duke’s proposed rate increase, saying even the revised request would allow excessive profits while raising household bills.
Duke spokesperson Caroline Fountain said the increase would pay for poles, wires and technology that helps prevent outages as North Carolina grows. That growth includes power-hungry data centers, which are helping drive up Duke’s forecast for electricity demand.
“We’re working to keep reliability at the lowest possible cost, and that’s why we reduced our proposed rate increase by over half,” Fountain said.
As WRAL reported in August, Duke Energy Progress reached an agreement with the state’s consumer advocates and other groups to scale back its request. The deal would also return tax credits to customers sooner and provide refunds if planned upgrades aren’t finished on time.
Attorney General Jeff Jackson refused to sign the agreement, saying customers would still be paying more than Duke needs. State regulators will decide whether to approve or change the deal. If approved as proposed, the first increase would take effect Jan. 1, 2027.
Business
Airbnb Hosts Are Furious They Can No Longer Make Guests Do Their Chores
Airbnb hosts are melting down over a new policy banning them from making guests complete tasks that “would typically be performed by a cleaner,” like “stripping the bed, taking trash offsite, or washing and putting away dishes.”
The change, which applies to all bookings made on or after November 20, quickly sparked outrage after it was announced in an email to Airbnb hosts on Wednesday. Many began fuming online about losing the right to make their guests clean up after themselves.
“As hosts, we have a responsibility to protect our investments, our homes, and, in many cases, our personal living spaces,” one person wrote in Airbnb’s official forum for hosts. “The problem is that Airbnb increasingly expects hosts to accept the risks while limiting our ability to protect ourselves.”
“Airbnb is like an abusive partner,” wrote one user on the Reddit community r/airbnb_hosts. “I’m alive long enough to recognize how truthful those few words are,” another person replied. “Until and unless I see substantive changes, I’m finally out.”
A different self-described host declared that going forward, the kitchens in their rentals will be “stripped down to only bare essentials.”
Many guests, meanwhile, are celebrating. For years, travelers have complained about having to pay hefty cleaning fees as part of their Airbnb bookings, only to be required to complete a list of chores before checking out.
“The guest experience has become total ass,” one person said in a subreddit for Airbnb hosts. “Clean dishes and run in the dishwasher. Strip the beds, put all linen in the laundry room. Take out all garbage, put in garbage can, take to the curb. Honestly, knock it off.”
Airbnb noted in its Wednesday announcement that hosts can’t get around the new policy by listing cleaning tasks in the “Requests” section of their listings instead. Airbnb spokesperson Simon Letouze tells WIRED that hosts can still make “reasonable” requests, such as asking guests to put dirty dishes in the sink. Other examples Airbnb cites includes asking guests to take short showers in areas with drought-related water restrictions, or telling them to place trash in bear-proof containers.
In a Facebook group for Airbnb hosts, one person posted what they claimed was a screenshot of their failed attempt to edit their property’s “Requests” section. They tried to ask guests to wash and air-dry dishes, put dirty towels in the laundry room, and take trash to a dumpster at an RV park they could find using a map on the refrigerator. But they realized they couldn’t hit save. Airbnb’s interface had underlined and highlighted the requests in red and displayed a pop-up that read “Guests shouldn’t be asked to do this task.”
Hosts also can’t circumvent the new policy by giving guests a printed list of rules and asking them to sign it when they check in. On November 20, Airbnb is also banning hosts from requiring guests to sign separate contracts, with limited exceptions for local legal requirements, longer stays, or accessing “an optional amenity” like a “golf cart rental.”
If one of these situations applies, hosts have to mention it in the dedicated section of their listing. Airbnb adds that it “doesn’t help enforce the terms of these contracts.” Hosts who violate either policy, Airbnb warns, may receive warnings, or in severe situations, have their listings removed, or be banned from the platform entirely.
In a Facebook group for Airbnb hosts, one person posted a letter they claimed to have sent to company executives, demanding the ability to set their own “common-sense expectations” for guests. They encouraged others to send their own versions. Another asked if they should raise their prices, while a third called for hosts to organize a platform-wide strike.
“Even if we all unlist our properties for just a day or two, we can send a powerful message,” they wrote. “Airbnb built its empire on OUR properties. It’s time we reminded them who actually holds the power.”
Some hosts haven’t given up on finding a way to ignore or get around the changes. On Reddit, one person said they would simply move their rules to other sections of their listing, like “Guest Access.”(Airbnb did not immediately respond to WIRED’s inquiry about whether this would work.) Another person said they would give the guests a “house manual,” require the guest to read it, and provide a “codeword” as proof. (Several pointed out that this is not only unenforceable, but against current Airbnb policy.)
“First sentence of my requests section will now state ‘Here are my house rules!’” another person said, though it’s unclear whether Airbnb’s interface will allow this. They named “not smoking” as an example of one of their house rules, but Airbnb has said it enforces host-imposed smoking bans.
Unwanted smoking and other serious scenarios—like letting dirty dishes become “health hazards,” leaving “permanent stains on sheets,” and creating “mountains of rotting garbage” —were invoked by several hosts. But these policy adjustments, seemingly, will not change how any of these things are treated.
Airbnb already has its own ground rules that all guests must agree to. The general credo is to “treat your host’s home like your own,” which translates to things like putting trash in the trash can, and not leaving moldy dishes.
If a host finds anything was damaged or went missing during a stay, guests are expected to pay a “reasonable” amount to repair or replace it. Hosts are also protected through the platform’s protection program, AirCover, which will reimburse up to $3 million for certain property damage caused by guests, including furniture, cars, and other belongings.
Additional cleaning costs, such as performing “smoke odor removal” or handling “pet accidents” are also covered by AirCover. Airbnb notes that the cleaning fees hosts are allowed to set are only meant to cover standard guest turnover tasks like laundry and vacuuming. Hosts can’t “charge guest fees for failing to perform specific cleaning or checkout tasks,” though they can still leave guest reviews “based on cleanliness.”
In the Airbnb Hosts subreddit, a few lurking guests were quick to bring up the cleaning fees, which are famously the subject of their ire. One self-described “mostly guest” said they’re not opposed to running the dishwasher or stripping the bed. “Just don’t charge me a cleaning fee over $100 then,” they said.
“Truth nuke,” another person replied. “Why would I have to pre-game the cleaners?”
Business
Meta’s Muse AI agent achieves strong growth, company introduces new shares to power investments
Shares of the company rose more than 4% in extended trading, as it also forecast fourth-quarter revenue above Wall Street estimates.
Sign up here.
The Facebook and Instagram parent has been pouring money into advanced chips and data centers to compete more aggressively with OpenAI and Anthropic, eroding its historically strong free cash flow.
Meta will issue a new class of non-voting Class C common stock in January 2027, effectively resulting in a two-for-one split, to fund acquisitions and retain top talent while maintaining CEO Mark Zuckerberg’s control amid Silicon Valley’s intensifying AI race.
Zuckerberg said more than 10 million people in the US and Canada have set up Muse accounts in a month and a half and growth remained strong. He said he expected Muse would serve “billions of people” who would potentially generate more revenue than the average Meta user.
“We want to help every person have an extremely capable personal agent that understands your goals and can help you achieve them and improve your life in whatever ways you want,” Zuckerberg said on a conference call after Meta published its financial report.
The company raised the lower end of its annual spending forecast, now expecting capital expenditure to be between $135 billion and $145 billion this year, up from $130 billion to $145 billion expected previously.
The company reported better-than-expected revenue of $64.60 billion for the quarter ended September 30, ahead of Wall Street estimates of $63.37 billion, according to data compiled by LSEG.
The company projected fourth-quarter revenue between $73 billion and $76 billion, above estimates of $73.73 billion.
Meta reported a free cash flow deficit of $2.12 billion in the third quarter, compared with positive free cash flow of $10.63 billion a year earlier.
“Our investments are paying off, the core business is strong, and we’re seeing velocity across the board,” Zuckerberg said in a statement.
The early popularity of its consumer-focused AI agent Muse and the release of a competitive new series of AI models have helped Meta justify its spending to investors, even though some enterprises are restricting the agent’s access over security concerns.
“The market has shifted from punishing Meta for spending to rewarding it for having a compelling product story,” said Jesse Cohen, senior analyst at Investing.com.
Legal challenges are also mounting, including a $25 billion penalty ordered by a judge in New Mexico earlier on Wednesday after a jury found Meta misled the state’s residents about how it shared user data with third parties and enforced policies on hate speech and misinformation in a case related to British political consulting firm Cambridge Analytica.
In August, Meta agreed to pay as much as $18 billion over a decade and restrict teenagers’ use of Facebook and Instagram to settle claims by nearly all US states alleging that Meta’s platforms were designed to addict children.
The $25 billion penalty is a “stark reminder of the current legal challenges Meta faces, which will continue into next year,” Emarketer senior analyst Minda Smiley said. “Questions and concerns related to privacy and safety will only ramp up should AI agents become more mainstream, which could ultimately hurt Meta considering its reputation in this area.”
Meta posted diluted earnings per share of $3.83 in the quarter, a figure that would have been $7.40, had it not been for a $9.89 billion charge related to the August settlement.
The agreement removed a significant regulatory hurdle that had weighed on Meta’s stock and allowed the company to avoid a potentially lengthy trial that could have exposed more internal documents about its treatment of young users.
Almost all of Meta’s revenue comes from advertising, with Reels competing with TikTok and YouTube Shorts for dominance in the short-video market and Threads taking on Elon Musk’s X, while its AI sharpens ad targeting and recommendations to boost user engagement.
Adds CEO quotes and Muse usage
Reporting by Jaspreet Singh in Bengaluru; Editing by Diti Pujara and Nia Williams
Business
Meta says Muse has over 10M users, with shopping a top activity
Meta said during its third-quarter earnings call on Wednesday that its AI app Muse has been adopted by more than 10 million users, confirming estimates released earlier this week by market intelligence firm Sensor Tower.
But it is how people are using it, and how much they’re spending that has caught CEO Mark Zuckerberg’s attention. Zuckerberg said about 25% of people who set up Muse now use it daily, helping improve retention.
He also shared that over a quarter of Muse’s engaged users who were shopping via the AI agent, had an average purchase size of over $200, which was surprising even to industry insiders.
“Plaid told us that they hadn’t seen activity like they’re seeing with their connector on any other service before,” Zuckerberg said, referring to the financial technology company that connects payment apps to customers’ bank accounts. Muse uses Plaid’s connector to enable agentic shopping.
Beyond shopping, Zuckerberg said other popular uses for Muse include personal productivity tasks, such as connecting the AI agent to users’ email or calendars. The exec stressed that this indicates users trusted Muse’s security setup, which includes a feature called “Muse Secure VM” designed to protect their data and privacy. He also mentioned that the forthcoming “Muse Confidential VM” will prevent even Meta from seeing users’ content.
Now that Muse has achieved “product-market fit,” Zuckerberg said Meta’s focus will shift to scaling the AI agent, increasing revenue, and optimizing its compute costs. Remarkably, the tech company is forecasting that Muse will eventually bring in more revenue per user than its “family of apps” users do today — meaning its users on Facebook, Instagram, WhatsApp, and Messenger. Currently, that figure is around “several hundreds of dollars annually,” Zuckerberg said.
Meta has said it ultimately intends to monetize Muse by keeping it free for most users, but keeping a percentage of the commerce taking place on the platform. Power users who want access to the most advanced AI models or more tokens will also have to pay.
Zuckerberg also noted that Meta believes Muse will be profitable after it scales.
“On the compute side, we are building out the capacity to serve more than a billion people over the next few years,” he told bankers and analysts on the Q3 earnings call. “In the near term, Muse is very compute-intensive to run, but we expect to improve its cost efficiency by more than 10x in the next year, which will enable it to be profitable once the revenue lines are at scale.”
Muse will also play a central role in Meta’s smart glasses strategy. Reality Labs, the division responsible for smart glasses, VR, and the metaverse, is still losing billions. However, the division’s losses are expected to improve from $19.1 billion in 2025 to $15 billion this year.
Beyond scaling and supporting its hardware strategy, Zuckerberg teased the company’s plans for something he called the “Muse network.” He described this as taking Muse from a “single-player game” to one where “your Muses can work with your friends’ and your families’ [Muses].”
“And if you want to buy something, it’s not just navigating to that business’s website; it’s talking to their agent,” he added.
Business
SpaceX Tesla Merger: Elon Musk Just Called it a Good Idea
A possible merger between Space Exploration Technologies Corp (SPCX +7.80%) and Tesla (TSLA +3.41%) has been rumored for months. Ever since Elon Musk took his space and technology conglomerate public, investors have anticipated bringing his electric vehicle and battery company into the fold. One public company for all of Musk’s endeavors — more or less.
After SpaceX’s earnings call on Tuesday, Oct. 20, 2026, the idea looks to have real traction.
Musk told investors that both businesses have formed special committees of independent directors to explore such a merger, though he said he cannot participate in those discussions because he is a “conflicted party.” Still, his view was made clear: “Do I think it would be a good idea? Yes.”
SPCX – Space Exploration Technologies
$159.31+$11.52 (+7.80%)
NASDAQ · As of 4:00 PM ET 10/21/26
Key data points
Market capMarket cap calculated using publicly traded shares outstanding only. Does not include unlisted, private, or dual-class non-traded shares. Implied market cap may vary.$2.01T
Day’s range$156.93 – $166.18
52wk range$104.83 – $225.64
Volume220.7M
Avg volume95.5M
This is still exploratory at this point, and no details of any possible deal were revealed; investors should know that, even if a merger is proposed, it doesn’t mean it would be approved by shareholders. While Musk has majority voting control of SpaceX, Tesla is another ballgame.
SpaceX’s AI growth comes with massive spending
SpaceX delivered a strong Q3 report on Tuesday. Top-line sales reached $14.6 billion, up 161% from a year earlier, and net income hit $4.4 billion. Both came in well above Wall Street’s targets.
The AI business was the biggest growth driver, thanks to its AI compute contracts. Revenue for the unit reached $7.6 billion, almost triple its Q2 revenue. Starlink was still a major driver as well and a strong profit source: the connectivity segment delivered $2.4 billion in operating income.
Of course, that growth comes with a massive bill. SpaceX spent $19.6 billion on capital expenditures during the quarter and expects to spend another $35 billion to $40 billion in the fourth quarter.
Tesla’s profits fall as robotaxi operations expand
As expected, Tesla delivered a much more mixed quarter. Revenue was essentially flat year over year, coming in at $28 billion, while net income fell a whopping 43% to $787 million. Vehicle deliveries slipped slightly, and operating expenses climbed as the company continued shifting its focus to AI and robotics.
There were some bright spots operationally: Tesla launched Cybercab in Austin in September and said that “cumulative unsupervised Robotaxi miles grew eightfold quarter over quarter.” It also began producing Optimus robots on its Fremont production lines.
The cash picture was improved as well, with Tesla generating about $1.5 billion in free cash flow (FCF) — the money left after operating expenses and capital spending. That was negative in the previous quarter.
What a SpaceX-Tesla merger would mean for shareholders
So will there be a merger? I think it’s likely one will be on the table. I do think it may be harder to pull off than some investors believe. First, will Tesla shareholders be on board? And if they are, how might regulators react? I could see a merger facing serious scrutiny.
Of course, the first question will come down to the details. For my money, investors should judge any proposal on its price and what it would do for the business they already own.
-
Business4 days ago‘Black Monday’ fears intensify as prediction markets shrug off 2026 crash
-
HealthNews2 weeks agoDes Moines clinics stumped by unidentified virus
-
Entertainment2 weeks agoTaylor Swift and Travis Kelce hold hands on NYC date night amid bitter feud with neighbors
-
Business2 weeks agoVistra Stock, Constellation Soar On AI Nuclear Energy Deals
-
Business2 weeks agoOpenAI, Anthropic, Meta, Google stop short of AI safety guarantee
-
Tech2 weeks agoCIA officer arrested with gold bars admits he exposed secret intelligence source to a foreign official
-
Business2 weeks agoMistral’s new 1T model aims to leapfrog closed and open rivals
-
Entertainment2 weeks agoTaylor Swift Celebrates Travis Kelce’s 37th Birthday in a Plunging Lace LBD and Outfit Worth Over $10,000
