Thursday, October 22, 2026 · 5 min read
Together with
AI helped find two critical holes in the code behind most of the world's websites, and attackers were testing them before the fix came out on Wednesday. Governments took their own sites offline to be safe.
A judge told Meta to pay New Mexico $25 billion, hours before Meta said it'll create a new class of shares with no vote to help pay for its AI spending.
Let Meerkat explain.
AI found a hole in the web, then lost the race to keep it quiet
Meta's $25 billion bill and its no-vote shares
A near-record S&P on thin legs, in one chart
The Fed, Alphabet, Microsoft and Amazon ahead
SCOREBOARD
NVIDIA | MICROSOFT | ALPHABET |
META | AMAZON | ORACLE |
S&P 500 | NASDAQ | VIX |
Wednesday close. S&P up 0.6%, with chipmakers leading after upbeat results from SpaceX and Super Micro. On the week: Nvidia +0.3%, S&P +0.5%, Nasdaq +0.0%. Prices via CNBC.
ON WATCH
AI found a hole in the web
AI tools helped uncover two critical flaws in PHP, the language behind about three in four websites whose code can be identified. The fixes came out on Wednesday, and some governments switched off their own sites while they patched.
Security firm Calif says it found the bugs with an AI model on 1 August. Wiz found them too, with help from Google's and OpenAI's models, and says they'd sat in the code for over a decade.
The plan was a quiet fix, and someone got there first. Amazon's security chief CJ Moses says its decoy servers caught an attack attempt on 17 October, four days before the flaws went public.
By Wednesday, Amazon said PHP2Shell "is now being broadly exploited in the wild." The Dutch cybersecurity agency took its own website offline, and France's Interior Ministry put all of its sites into maintenance.
Censys counts about 1.5 million of 2.6 million PHP servers running a version with no fix. Only PHP 8.2 and newer get patches, so older sites can't simply update.
On the other hand, AI found these flaws for the good guys first, nearly three months before the fix shipped. Security firm watchTowr said on Wednesday that nobody had pulled off a successful attack yet.
MEERKAT'S TAKE: The defenders used AI, had a head start of almost three months, and still couldn't keep it quiet for the last four days. Meerkat's worry is the 1.5 million servers nobody is paid to update.
SPONSORED
See What's Moving Before Wall Street Wakes Up
Most of us hear about a stock move after it happens — an earnings report, an AI contract, a sector suddenly running — and by the time the news reaches us, the opportunity is gone.
We created Elite Trade Club to fix that.
Each trading day, our team publishes a pre-market briefing built for active traders: stocks surging or collapsing before the open, key earnings that could move markets, under-the-radar companies gaining institutional attention, and the macro events worth watching today.
Fast, practical, straight to the point.
That's why 450,000+ traders rely on us every morning. Get the daily briefing free — no cost, no catch.
By clicking, you’ll receive this and other Elite Trade Media LLC financial newsletters, which may include advertiser offers. Publications · Privacy · Unsubscribe anytime.
THE MACHINE
Meta's $25 billion bill
A New Mexico judge ordered Meta to pay the state $25 billion on Wednesday, after a jury found it misled users about their privacy. Part of the case grew out of the Cambridge Analytica scandal, and jurors found 43 million violations.
Meta's chief legal officer, C.J. Mahoney, said the ruling "makes it all but impossible to do business in the state of New Mexico." Meta will appeal.
Hours later, Meta's results showed a $9.89 billion charge for a separate settlement with state attorneys general over teens, cutting operating profit 37%. After spending on servers and data centres, free cash flow was minus $2.1 billion.
Let Meerkat translate. Meta is creating a new class of shares with no vote, handed to every shareholder, that it can also sell to raise money. Its finance chief said it gives Meta "flexibility to invest" behind momentum "driven by AI."
Then again, revenue rose 26% to $64.6 billion in the quarter, and earnings per share excluding one-off items rose to $7.40 from $7.25.
QUICK PAUSE. WHY SHOULD YOU CARE? If you own Meta shares, a no-vote share for each one you hold arrives on 19 January, and Mark Zuckerberg keeps control. Meta can then sell shares to fund AI without anyone new getting a say over how it spends.
SOMEONE SMART SAID
We likely sacrificed a significant chunk of a several-month model lead.
Amodei wrote that in a long post on X, answering Nathan Calvin of the safety group Encode. Calvin listed nine Anthropic moves, from giant computing deals to changes in its safety pledges, and said its own staff would condemn them if OpenAI made them.
Amodei's answer is that safety has already cost Anthropic. He says it had Mythos-class models in February but held back a general release until June while it built stronger cyber safeguards. He conceded three of Calvin's points and wrote, "I take responsibility."
Anthropic wants to list as soon as next month. Investors would be buying a company whose boss has put in writing that safety cost it a lead.
THE CHART
Near a record, on thin legs
S&P 500, month-end closes, CNBC, January 1985 to 21 October 2026
The S&P 500 closed at 7,757 on Wednesday, within 0.8% of its record high. Chipmakers did the lifting, with the Philadelphia chip index up 2%.
The rest of the market did less. The equal-weighted S&P, where every company counts the same, rose only 0.36%, and on the Nasdaq 216 stocks hit a 52-week low against 53 new highs.
That said, the leaders are bringing real numbers. SpaceX reported its first profit as a public company, $4.4 billion, and Super Micro raised its quarterly sales outlook to $18.5 billion to $19.5 billion.
WHAT TO WATCH: If Alphabet's and Microsoft's results on 28 October lift the rest of the market with them, the rally gets wider legs. If the equal-weighted index keeps trailing, the record rests on a handful of names.
HEADS UP
Nvidia is paying its suppliers to build faster · It's advancing $1.1 billion to KYEC for US chip testing, and its supply commitments hit $279 billion in July, up from $119 billion.
DeepSeek raised about $15 billion · Battery maker CATL and Tencent were among the biggest backers of the Chinese lab's round, Bloomberg reports. Reuters couldn't confirm it.
OpenAI's old safety chief is back · Aleksander Madry, who ran its Preparedness team, returns five months after leaving to work on safety and security with chief scientist Jakub Pachocki.
Blackstone says the AI debt panic is overdone · Jas Khaira, who runs its AI hub, says this isn't 2008, though he concedes borrowing costs for the biggest tech names have widened.
Anthropic opened a waitlist for Claude Duet · The always-on agent, for US Pro and Max users, sends a morning brief and messages you when something needs doing.
ON THE HORIZON
When (ET) | What |
|---|---|
Tue 27 Oct | Fed meeting begins |
Wed 28 Oct · 2:00pm | Fed decision, press conference 2:30pm |
Wed 28 Oct · after close | Alphabet and Microsoft Q3 results |
Thu 29 Oct · after close | Amazon Q3 results |
Week of Mon 9 Nov | Anthropic could start pitching its shares to investors, per Bloomberg |
MEERKAT ON YOUTUBE
Oracle's $300B AI Bet Is Falling Apart! Oracle still makes money, yet the bond market now charges about four times as much to insure its debt. Meerkat explains the one thing Oracle changed. Watch on Meerkat Explains.
THE BURROW
Quick vote. AI helped find a hole in the code behind most websites, and attackers tried it before the fix was out. Who's winning the AI security race?
AI helped find a hole in the code behind most websites, and attackers tried it before the fix was out. Who's winning the AI security race?
Trivia. In 1988 a Cornell graduate student released one of the first programs to spread itself across the internet, and it slowed thousands of computers to a crawl. What's it called? Answer's at the bottom of the email. No peeking.
ALSO WORTH YOUR INBOX
The daily crypto brief from the same burrow. Crypto Nutshell is Bitcoin, the news and the numbers in a five-minute read.
HOW DID WE DO?
One tap, and Meerkat listens. How did today's issue land? Hit a button, and add a line if you want to tell Meerkat why.
How did Meerkat do today?
If you run a website, today's the day to ask which version of PHP it's on.
Anyone holding Meta stock should read The Machine. Forward them this.
Meerkat is not a financial adviser, and nothing here is advice. Meerkat is a small animal with a whiteboard and a ruler that measures 0.8%. Please do not sue Meerkat.
TRIVIA ANSWER
The Morris worm. Robert Tappan Morris said he wanted to measure the internet, but a bug made it copy itself far too often, and he became the first person convicted under the US computer fraud law.