One Power Glitch at Google Cloud Freezes UK Banking Apps, PHP Rushes Out Fixes for Two Critical Flaws, and Anthropic's IPO Filing Shows What Frontier AI Really Costs
By Noah Smith, Owner & Consultant, KeyChange Technologies · October 21, 2026
Here is today's AI and IT news for busy owners: one power problem in one London data center that froze banking apps for millions, a critical PHP patch landing today, and Anthropic's IPO paperwork pulling back the curtain on what frontier AI really costs.
📌 The AI and IT news at a glance
- One power failure at Google Cloud London knocks Revolut, Lloyds, and HSBC customers offline.
- PHP, the language behind most websites, ships emergency fixes for two critical flaws today.
- A Chinese AI hacking tool is tied to breaches at dozens of Japanese companies.
- A hacker gets 8 years for phishing small tax-prep firms and cashing their clients' refunds.
- A certificate authority's digital ID keys turned out to be guessable in 256 tries.
- Mistral launches Voxtral 3, a cheap, full voice-agent stack.
- Anthropic's draft IPO filing reportedly shows an $80.7 billion half-year loss and up to $750 billion in future compute.
- New York City proposes fines for AI customer service "doom loops."
- ChatGPT lets you lock chats behind a PIN or Face ID.
- Gemini on Android Auto can now read your Gmail and Calendar to plan your drive.
Catch up on yesterday's edition here: One hacker turns AI agents loose on John Deere and SharkNinja.
🔝 Top story
One power failure in one Google Cloud zone freezes UK banking
Early on Tuesday, October 20, Google Cloud's London region (europe-west2) started throwing errors. Google says the incident began at 23:08 Pacific time Monday, just after 7 a.m. in London, and later explained it plainly: "Due to a power event we had suffered an outage within europe-west2-b zone." That is one of the three availability zones in Google's London region, but the knock-on effects spread across dozens of Google services, including Kubernetes Engine, Cloud Run, App Engine, and BigQuery data transfers.
The customers felt it fast. Revolut, which says it has 80 million users, reported a "service disruption affecting multiple services" and later attributed it to Google Cloud, saying customers' money and data were safe. Downdetector also lit up for Lloyds, HSBC, Royal Mail, Rightmove, DPD, BT, and Screwfix, and the budgeting app Emma said its own outage came from Google Cloud and was "not a security issue." Lloyds did not blame Google. Google said the power event was mitigated around midday London time and expected a full recovery of existing workloads by the afternoon, but Revolut's status page was still showing services "partially unavailable" hours later.
In short: A power problem in a single Google Cloud data-center zone in London disrupted banking apps and other services used by millions on October 20.
What it means for your business: If your bank, payment processor, or key software vendor all lean on the same cloud region, one bad morning there becomes your bad morning. Ask your critical vendors where they run and what happens when that location goes dark.
My take: "We are on the cloud" is not a disaster plan. Cloud zones exist so one power hiccup doesn't take you down, but only if the app is actually built to fail over, and plenty are not. For a small business the practical move is boring: keep a second way to take payments and a second way to reach your money, and know who your vendors depend on. Your redundancy is not redundant if everything plugs into the same wall.
Source: The Register
🛡️ IT and security
PHP ships emergency fixes for two critical flaws today
The PHP project warned administrators on October 20 that it will release patches for two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, on Wednesday, October 21 at 14:00 UTC (10 a.m. Eastern). PHP rates each flaw 9.2 out of 10, and the security firm watchTowr, which says it has reproduced one of them, calls them perfect 10s that are "understood to affect PHP versions 5, 6, 7, and 8." PHP has not published which exact versions are affected and says it may release early if details leak or attacks begin.
Why this matters beyond the developer world: PHP is the engine under WordPress, WooCommerce, and a huge share of the web's small-business sites, booking pages, and customer portals. watchTowr says it has not seen exploitation in the wild yet. The concern is the window right after a fix ships, when attackers compare old and new code to work out how to break unpatched sites.
In short: PHP will release fixes today for two critical flaws that likely affect most PHP versions in use.
What it means for your business: If your website runs on WordPress or anything PHP-based, someone needs to apply today's update, whether that is your host, your web agency, or you.
My take: This is a "send one email today" story. Ask whoever hosts your site: are you applying the October 21 PHP patches, and when? Managed hosts usually move fast. The sites that get burned are the ones on old PHP versions nobody has touched in years, so if you hear "we're still on PHP 7," treat that as a bigger problem than this patch.
Source: BleepingComputer
A Chinese AI hacking tool is tied to breaches at dozens of Japanese companies
GMO Internet Group's security arm said on Tuesday, October 20, that an AI-powered penetration-testing tool called Artex, built in China and meant for legitimate security testing, was used in a wave of attacks almost entirely aimed at Japan. It traced the activity to six servers running the tool, broadly linked to finance, e-commerce, and logistics targets, and shared its findings with law enforcement. GMO said, "Multiple incidents of damage have resulted from attacks by the same group."
The backdrop: dozens of Japanese companies, including restaurant chains and a car rental operator, have disclosed breaches in recent weeks that could touch millions of customers. South Korea has separately linked Artex to hacks on financial institutions. The tool's developer says attacks are "entirely contrary to" its intent, and it has cut off access to the source code and stopped updating the project.
In short: A Japanese security firm says a Chinese AI security-testing tool was misused to attack Japanese finance, e-commerce, and logistics firms.
What it means for your business: AI is lowering the cost of probing companies for weak spots, so ordinary gaps like unpatched sites and reused passwords get found faster.
My take: This is the same pattern we saw in yesterday's edition with one hacker using AI agents against 100-plus company websites, now at a national scale. You do not need to understand the tool to respond to it. Patch on schedule, turn on MFA everywhere, and stop assuming you are too small to be noticed. Automation means nobody is too small anymore.
Source: The Korea Times
A hacker gets 8 years for phishing small tax-prep firms
A 40-year-old Nigerian national, Chukwuemeka Victor Amachukwu, was sentenced to eight years in prison, federal prosecutors in Manhattan announced on October 20. Between 2019 and 2021, he and co-conspirators sent targeted phishing emails to tax preparation businesses in New York, Texas, and other states, broke into their computers, and stole tax and personal data on at least 800 clients.
They used that data to file fraudulent returns and loan applications, claiming $8.4 million in refunds and collecting about $2.5 million, plus roughly $819,000 in fraudulent SBA disaster loans. He was also part of a separate fake-investment scheme that took more than $7 million. He was ordered to pay $3.6 million in restitution and forfeit nearly $11 million.
In short: A hacker who phished small tax firms to steal client data and file fake refunds was sentenced to eight years.
What it means for your business: If you hold client financial data, a single convincing email to one staff member can turn into fraud filed in your clients' names.
My take: I like this story because the victims look exactly like our readers: small, busy offices with valuable data and no security team. Nothing fancy happened here. It was phishing. With tax season a few months out, now is a good time to run a quick refresher with your team and lock down remote access.
Source: BleepingComputer
A certificate authority's digital ID keys turned out to be guessable in 256 tries
This is today's one technical story, and it earns the slot because it breaks an assumption almost everyone holds about the padlock in the browser. Certificate authority eMudhra revoked eight intermediate certificates after researcher Wayne found on October 17 that their private keys were absurdly weak: a script error meant the keys came from a pool of just 256 possible values, so anyone could recover them almost instantly. One researcher published a recovered key, which BleepingComputer verified.
With those keys, an attacker could in theory have issued fake certificates for real websites and intercepted encrypted traffic, possibly since April 2025. There is no evidence that happened, and eMudhra says most of the certificates were never used in production. Mozilla and Google blocked them on October 17, Apple added protections on October 19, and Mozilla shipped Firefox 158.0.1 on October 20. Software with its own certificate list can keep trusting them until it is updated.
In short: A certificate authority's keys were so weak they could be guessed, so browsers blocked eight of its certificates.
What it means for your business: Your browsers are already protected, but older devices and business software that do not update their certificate lists may not be.
My take: No need to panic here, since the browser makers moved within days. The lesson is about the gear nobody updates: the old point-of-sale box, the scanner, the custom app. If something in your office has not had an update in years, it is quietly trusting a list from years ago.
Source: BleepingComputer
🤖 AI generally
Mistral launches Voxtral 3, a cheap, full voice-agent stack
French AI lab Mistral announced Voxtral 3 on October 20, a family of speech models plus a Voice Agents SDK for building phone and web assistants. The lineup includes Voxtral Small Transcribe 3, Voxtral Mini Transcribe 3 (a 4-billion-parameter model in batch and realtime versions), and Voxtral Mini TTS 3.0 for speech generation with voice cloning. Mistral says transcription covers more than 50 languages and speech output more than 35.
Pricing is aggressive: batch transcription starts at $0.0035 per minute, realtime at $0.008 per minute with sub-half-second latency, and text-to-speech at $13 per million characters. Businesses can use it through Mistral's EU, US, or global API, or run it on their own infrastructure so audio never leaves their environment. The SDK is built on LiveKit and connects over phone lines (SIP) or the web, with agents that can book appointments, check bills, and look up records.
In short: Mistral released Voxtral 3 speech models and an SDK for building low-cost voice agents that can also run on your own servers.
What it means for your business: Answering phones and taking bookings with AI is getting cheaper, and you no longer have to send every call to a US cloud to do it.
My take: The self-hosted option is the real news for anyone in healthcare, legal, or finance who has avoided voice AI because of where recordings end up. The low per-minute price makes testing cheap. Just read the New York story below before you put a bot on your main line.
Source: TestingCatalog
Anthropic's draft IPO filing reportedly shows huge losses and up to $750 billion in future compute
Anthropic's draft S-1 prospectus, reviewed by the Wall Street Journal and Reuters and reported on October 20, reportedly shows a net loss of $80.7 billion for the first half of 2026, up from $13 billion a year earlier. About $72 billion of that is a non-cash accounting charge tied to the rising value of convertible notes, not money out the door. Cash spending on compute and infrastructure was close to $9 billion in the half, up from $2.3 billion.
The filing reportedly says Anthropic could spend as much as $750 billion on more computing capacity in coming years, with about $450 billion already contracted over seven to ten years, including $111 billion with Google Cloud, $110 billion with Amazon Web Services, and $31 billion with Microsoft. According to people familiar with the matter cited in the reports, Anthropic told investors it hit adjusted profitability in the third quarter. Marketing for the IPO could begin the week of November 9. Anthropic did not comment, and these are reported figures from a draft, not a final public filing.
In short: Reported details from Anthropic's draft IPO filing show an $80.7 billion first-half net loss, mostly from accounting charges, and plans for up to $750 billion in compute.
What it means for your business: The AI tools you rely on sit on enormous, long-term infrastructure bets, which is why pricing, rate limits, and plan changes keep shifting.
My take: Do not read the headline loss as "Anthropic is going broke." Most of it is an accounting charge. The figure that matters to customers is the compute bill, because that is what ultimately sets the price of every AI seat you buy. Expect all the big labs to keep reshuffling plans as they chase profit, and keep your workflows portable between providers.
Source: Yahoo Finance (Bloomberg)
New York City proposes fines for AI customer service "doom loops"
New York City's Department of Consumer and Worker Protection proposed rules on October 20 for businesses that use AI chatbots and automated phone systems. Businesses would have to tell customers when they are talking to an automated system, offer an easy way to reach a human, and could not dodge responsibility when their AI breaks the law. The rule would also make it a deceptive practice to repeatedly fail to resolve inquiries or give irrelevant or wrong answers.
Violators would owe restitution plus civil penalties starting at $525. There is a 30-day comment period with a public hearing before the rule can be finalized. Mayor Zohran Mamdani said "customer service cost-cutting can't come at New Yorkers' expense."
In short: NYC wants to require chatbot disclosure and a path to a human, with fines for businesses whose automated support fails customers.
What it means for your business: If you sell to New Yorkers and use a chatbot or phone tree, you may soon need clear disclosure and a working "talk to a person" option.
My take: This is good practice whether or not you are in New York, and I expect other cities and states to copy it. A bot that handles the easy 60% and hands the rest to a human is fine. A bot that traps people is a lawsuit waiting to happen. Check your own setup: can a frustrated customer reach a human in two steps?
Source: NYC Department of Consumer and Worker Protection
🧰 New tools for builders and business AI
ChatGPT lets you lock chats behind a PIN or Face ID
OpenAI began rolling out Locked Chats on October 20 across Free, Go, Plus, Pro, Business, Enterprise, and Edu plans. You can lock a conversation with a four-digit PIN or Face ID or Touch ID, and it moves to a separate section that does not show up in history or search. Locked chats keep their own separate memory, so what you say there does not bleed into your normal chats.
OpenAI is clear about the limits: this is not end-to-end encryption, it does not change how long OpenAI keeps the data, and resetting your PIN permanently deletes everything that was locked.
In short: ChatGPT now lets users hide individual chats behind a PIN or biometrics, with separate memory.
What it means for your business: It helps on shared or borrowed devices, but it is a privacy screen, not a security control.
My take: Handy, and I will use it. But do not let staff treat "locked" as "safe to paste client data." Your AI policy should still decide what goes into ChatGPT in the first place.
Source: TechCrunch
Gemini on Android Auto can now read your Gmail and Calendar to plan your drive
Google started rolling out Personal Intelligence for Gemini on Android Auto on October 20. With it switched on, Gemini can pull from Gmail, Calendar, Photos, Maps, Search, and YouTube, so you can say "take me to my doctor's appointment" or "is my flight on time?" without reading out details. It is opt-in, and if you already turned it on in the Gemini phone app it carries over automatically. Android Automotive cars get it in the coming months.
In short: Gemini in Android Auto can now use your email, calendar, and photos to answer questions and navigate.
What it means for your business: Road warriors on Google Workspace get a really useful hands-free assistant, and IT gets one more place company email is being read.
My take: For anyone who drives between client sites all day, this is the kind of AI that actually saves time. If you manage company Google accounts, check whether your Workspace settings allow it and decide on purpose, rather than finding out later.
Source: 9to5Google
That is today's AI and IT news. If one story deserves five minutes of your time today, it is the PHP patch: check with whoever runs your website.