Intro

PHP-aggedon kept rolling, with patches covering only PHP 8.2 and newer. Anthropic unveiled Claude Duet, a proactive background agent. Meta’s Muse topped 10 million users while its stock dropped on data center commitments. iPhone Duo reviews landed, Gruber scathing.

• The PHP Foundation says its patches for the RCE vulnerabilities are limited to PHP 8.2 and newer, leaving legacy deployments dependent on third-party vendors (Wired)
• PHP-aggedon: OpenAI’s GPT-5.6 Sol and Google’s Wiz, with its Atlas agent and Gemini 4 Argon, found the decades-old flaws, which AI makes both findable and newly easy to exploit, so the race is on to patch tens of millions of sites (TechCrunch)
• Anthropic unveils Claude Duet, a proactive agent app on iOS, Android, and the web that works in the background, in research preview for US Pro and Max users (Claude)
• Duet runs on Opus 5.5, checks connected accounts every few hours, and asks approval before sending, paying, signing or deleting; research preview via waitlist for US Pro and Max subscribers (VentureBeat)
• Meta reports Q3 revenue up 26% YoY to $64.6B, operating income down 37% YoY to $12.99B on a $9.9B AG settlement, and family DAP up 3% YoY to 3.64B for September (Meta Investor Relations)
• Meta’s Muse agent app has passed 10 million users in the US and Canada since its September launch, with shopping the top use case and more than a quarter of users buying through it (Business Insider)
• iPhone Duo review: a fun device with a cool matte inner display, but the cover display is too small, it is heavy and bulky, the cameras are OK, and it gets hot (The Verge)
• 9to5Mac’s iPhone Duo review: after a week, the foldable looks like the future of the iPhone, though it has Touch ID instead of Face ID and no telephoto camera (9to5Mac)
• Gruber on the iPhone Duo: closed, it’s the worst iPhone Apple has ever made, while the inner display is a splendid tablet; an extraordinarily polished prototype at $2,000, not a finished product (Daring Fireball)

Subscribe to the ad-free feed.