Quick pulse for Friday, October 23. Short takes, with credit to where each one came from.
AI found a decade-old hole in PHP. Finland pulled the plug#
On Oct 21, PHP shipped emergency fixes for two critical flaws now called PHP2Shell (CVE-2026-109618 and CVE-2026-109619). Every PHP version since 5.4 is hit by at least one of them. Chained together, they let an attacker run code on a web server without logging in. Wiz says PHP runs about 70% of websites, including WordPress, Drupal and Joomla. A plain “Hello World” app on an affected version can be vulnerable.
AI did the finding. Wiz used Gemini 4 Argon and GPT-5.6 Sol, and says one researcher did in a week what used to take a top team months. Wiz found the first bug on Aug 19, so defenders had about two months to prepare.
It still got messy. Details leaked early. Cloudflare CEO Matthew Prince said the network saw thousands of exploit attempts in the 10 hours before the announcement, hundreds of thousands within two hours after it, and then millions. Censys counts about 39.7 million internet-facing services still reporting affected PHP versions, per Nextgov.
Finland pulled services offline. Valtori, the state ICT centre, started shutting public government web services on Wednesday afternoon. The National Land Survey, the Finnish Meteorological Institute and oikeus.fi went dark. Valtori’s firewall changes also broke some Suomi.fi logins, and on Thursday morning acting for a company in OmaVero could still fail, per Yle. Valtori’s Hannu Naumanen says a full return could take days or even weeks. Nobody has found a breach. These were precautions.
The same day, Microsoft said a China-aligned group it calls Storm-0940 used ARTEX, an open-source AI pentesting framework, after breaking into ConnectWise Cloud Backup. Its agents tried to sign in to more than 2,250 Microsoft 365 tenants at up to 2,900 attempts a minute. In some cases they had privileged cloud access less than 3 hours after first targeting.
If you run a site, update now: PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35. PHP 8.1 and older get no fix, so upgrade.
JPMorgan puts a number on bitcoin: 10% a year#
J.P. Morgan Asset Management released its 2027 Long-Term Capital Market Assumptions on Oct 19. It’s the 31st edition and the first with bitcoin. Pension funds and wealth managers use these 10-to-15-year forecasts to plan portfolios. JPM pencils in a 10% compound annual return for BTC, the top of its table. That beats private equity at 9.8%, U.S. large caps at 7.5%, a 60/40 portfolio at 7% and gold at 5.5%.
Source: J.P. Morgan Asset Management 2027 LTCMA, via Decrypt and Bitcoin.com News.
The catch is volatility. JPM assumes BTC swings 55% a year, against about 17% for gold. So the simple average return is 20.9%, but what a holder keeps after the drawdowns is about 10%. JPM also left bitcoin out of its main covariance matrices and model portfolios. It gives BTC a return range. It doesn’t tell clients to buy.
Milk Road ran the math. Compounding 10% from about $82K gets you roughly $213K in 10 years and $343K in 15. That’s their arithmetic, not a JPM target. Bitwise CIO Matt Hougan thinks the 55% volatility figure is too high, which would make the return too low. The competition is tougher too. JPM’s global bond forecast is 5.3%, its highest in two decades.
So why the shrug? BTC sits about a third below its ~$126K high from last October. Milk Road’s read: big institutional yeses now land so often that no single one moves the price.
Meta’s AI bill ate all its cash#
Meta reported Q3 on Oct 21. Revenue rose 26% to $64.6B, ahead of the $63.4B analysts expected. The problem was spending. Capex, including finance lease payments, hit $34.9B. That’s more than the roughly $32.8B the business generated from operations, so free cash flow was negative $2.1B. A year ago it was +$10.6B.
Meta also raised the floor of its 2026 capex range to $135B (top end still $145B). It is creating a new non-voting Class C stock, effective January 2027, partly to “provide Meta the ability to finance its growth.” The stock fell almost 7% on Thursday, and its five-year credit default swaps hit record highs, per CNBC. When the bond market starts pricing risk on Meta, the AI capex trade has a new problem.
Also noted: OpenAI moves onto Google Cloud#
OpenAI’s models and Codex are coming to Google Cloud’s Model Garden, announced Oct 21. Customers can pay through Google Cloud Marketplace and count it against their existing Google Cloud commitments. GPT-6 Astra, GPT-6.1 Sol and GPT-6 Luna start in private preview, with general availability “in the coming weeks.” Google says it’s now the only hyperscaler selling all three leading closed models. OpenAI’s exclusive deal with Microsoft ended in April, and it’s already on AWS, per Reuters. OpenAI still calls Microsoft its “primary cloud partner.”
InvestAnswers: Tesla’s cash surprise and the merger math#
Video: InvestAnswers live panel on Tesla Q3. Streamed October 21, 2026.
Tesla’s Q3 on Oct 21 beat. Revenue was $28.05B against about $27.9B expected, and adjusted EPS was $0.48 against $0.43 (LSEG). Gross margin rose to 19.6%, from 16.8% in Q2 and 18.0% a year ago. Auto margin excluding credits was 18.1%, above the 16.7% analysts expected (Visible Alpha). Operating cash flow was $6.3B and capex $4.7B, so free cash flow came in at +$1.5B when Wall Street expected a burn. Cash hit $45.4B. Active FSD subscriptions rose 67% from a year ago to 1.74M.
The cash came from spending less. Tesla cut its 2026 capex guide to about $20B from more than $25B, per Reuters. InvestAnswers calls the mood “AI capex fatigue,” and the Meta item above shows the other side of it: Meta got punished for spending, Tesla got questioned for holding back.
The stock didn’t follow through. It rose about 2% after hours, then reversed. On Thursday it dipped to $373.71, the gap-fill level InvestAnswers flagged, and ran to $388.86, but closed at $374.58, down 3.1%.
The bigger story for him is the merger. Reuters reports SpaceX approached Tesla in recent weeks. Both sides have hired advisers, talks are early, and the options include SpaceX buying Tesla or a merger under a new holding company, possibly all-stock. InvestAnswers’ math: a 30% premium on $379 is about $493, and at $160 a SpaceX share, 3 to 4 SpaceX shares per Tesla share is $480 to $640. He lands near 3. Brad Gerstner told CNBC the special committee will likely push for more than the usual 20-30% premium because Musk is on both sides, and put Tesla at $420 to $550 in a deal. JPMorgan raised its SpaceX target to $500 from $240. One caveat for the ratio math: SpaceX fell 9.1% on Thursday to $144.75, so 3 shares were worth about $434 at the close.
Also from his feed: spot bitcoin ETFs took in $524.8M on Wednesday, the third straight inflow day, led by IBIT ($235M) and FBTC ($212.7M). Bitcoin still slipped to about $81.5K, per Decrypt.
-Q
Sources#
Wiz: PHP2Shell · Google Cloud: Responding to the PHP CVEs · Cloudflare: php2shell WAF protection · Reuters via Investing.com: Cloudflare sees millions of exploit attempts · Nextgov/FCW: PHP flaws draw millions of attempts · Yle News: Finland shuts government websites · Yle: Valtori says repairs may take weeks · Microsoft Security: Storm-0940 and ARTEX · CSO Online: 2,250 Microsoft 365 tenants · Superintelligence: The night hacking hit machine speed · Milk Road: BTC to $343K, by JPMorgan’s numbers · J.P. Morgan Asset Management: 2027 LTCMA · Decrypt: JPMorgan puts a number on bitcoin · Bitcoin.com News: JPMorgan LTCMA · Meta: Q3 2026 results · CNBC: Meta sinks as free cash flow turns negative · Mando Minutes: 22 October · OpenAI: Models are coming to Google Cloud · Google Cloud: OpenAI models in Model Garden · Reuters via Investing.com: OpenAI on Google Cloud · InvestAnswers (Patreon): Tesla earnings good and up in after hours · InvestAnswers (Patreon): The good juice from the Tesla Q3 call · InvestAnswers (Patreon): I kept saying · InvestAnswers (Patreon): Merger smoke · InvestAnswers (Patreon): TSLA/SPCX math · InvestAnswers (Patreon): JPM monster target · InvestAnswers (Patreon): BTC ETFs · InvestAnswers: Tesla Q3 live panel (video) · Tesla: Q3 2026 update deck · CNBC: Tesla Q3 earnings · Reuters via Investing.com: Tesla cuts spending · Exa market data: TSLA Oct 22 · Exa market data: SPCX Oct 22 · Reuters via Investing.com: Musk’s endorsement may complicate talks · Yahoo Finance: Gerstner’s $420-$550 Tesla range · CNBC: JPMorgan raises SpaceX target to $500 · Decrypt: Bitcoin ETFs erase October losses