AI & Dev Trends: PHP2Shell Comes First, 26 October 2026

PHP2Shell deserves the first slot in your engineering queue for the week ending 26 October 2026, despite Claude Duet’s launch attention.

PHP2Shell puts patch verification ahead of model experimentation

On October 21, OpenAI described a coordinated disclosure and patching effort after GPT-5.6 Sol assisted Calif’s discovery of a critical PHP flaw. Its disclosure report makes this the week’s most consequential story for teams responsible for PHP applications, whether or not they use AI.

• Discovery: OpenAI attributes assistance in Calif’s research to GPT-5.6 Sol in its report.
• Disclosure: The same report describes the coordinated October 21 response.
• Technical follow-up: LiveOverflow’s October 22 walkthrough examines PHP2Shell and the race to an exploit.

Inventory runtimes across public applications, internal tools, container images and inherited services. Check whether they're affected and ship the appropriate update, including for forgotten PHP applications.

Claude Duet’s launch reach is a reason to investigate, not permission to deploy

Anthropic announced Claude Duet on October 21, and it led engagement among the sampled launches. Start with the official demonstration to examine the product’s authority boundaries.

For a hypothetical issue-triage workflow, separate permission to read a ticket from permission to assign it, notify a customer or modify production settings.

Before approving a pilot, write down:

• Which actions can happen without a person’s approval?
• Which actions require confirmation immediately before execution?
• Where can an operator inspect the action history and stop further work?

Record any gaps between this checklist and Duet’s documented controls.

DeepInfer makes open inference worth a workload-specific test

DeepSeek released DeepInfer on October 20 as an Apache-2.0 production inference framework for DeepSeek models.

• License: Apache-2.0, according to the DeepInfer repository.
• Source: Inspect the stack in the official repository.
• Announcement: DeepSeek’s release post.

Shortlist it if your team is already committed to DeepSeek models. The license gives you room to inspect and adapt the stack; performance and cost need testing against your workload.

Replay a representative application workload against your current serving setup and a DeepInfer deployment. Keep output requirements consistent, measure tail latency as well as throughput, and include deployment and on-call effort.

For a document-processing service, measure completed, acceptable documents within the service’s latency target. Raw token throughput can't tell you whether switching infrastructure improves that result.

Agent Skills gains a standards home, not an automatic trust boundary

On October 22, Anthropic donated Agent Skills to the Agentic AI Foundation. Anthropic said more than 70 agent platforms had already integrated the standard.

Test this shared format before maintaining separate versions of the same operational instructions across agent products. A skill that explains a release process should still require explicit credentials and authority to publish a release.

For a first compatibility test, choose a read-only workflow such as repository orientation. Run the same skill in two platforms your team uses, then record:

• Whether each platform discovers the skill.
• Whether the instructions produce the intended behavior.
• Which platform-specific permissions or dependencies remain.
• Whether the skill’s version and origin are visible to reviewers.

The guide to building agents that resume covers recovery after interruption, which needs a separate test: a portable instruction package doesn't handle it by itself.

Worth watching

• PHP2Shell remediation: Follow the advisories referenced in OpenAI’s disclosure report, and resolve any unowned PHP deployments in your inventory.
• Duet’s operational boundaries: Compare your approval and audit requirements with the capabilities demonstrated in Anthropic’s official video.
• DeepInfer workload evidence: Check the repository for documentation and results relevant to your model and deployment environment.
• Agent Skills compatibility: Track the standard through Anthropic’s donation announcement and its linked resources, focusing on the platforms your team uses.

Take Action

1. List every deployed PHP runtime your team owns, including containerized and internal services, and assign an owner to check each against the PHP2Shell-related advisories.
2. Review the Claude Duet demo and produce a one-page approval checklist covering read access, write access, external communication and operator intervention.
3. If you already serve DeepSeek models, select one real workload for a DeepInfer comparison and record throughput, tail latency, output acceptance and operating effort.
4. Test one read-only Agent Skill in two supported platforms, documenting compatibility differences before adding credentials or write permissions.

Useful Resources

• OpenAI’s coordinated vulnerability disclosure - Account of the AI-assisted discovery and coordinated response.
• Claude Duet official demonstration - Primary material for assessing the announced experience.
• DeepSeek DeepInfer repository - Source, license and project documentation.
• Agent Skills donation announcement - Governance change and Anthropic’s reported adoption.

The Bigger Picture

Give each experiment an owner and an acceptance test. PHP remediation goes first; the new capabilities can earn broader access after they demonstrate value inside boundaries you can enforce.