Daily Brief — October 26, 2026

• Rippling moved its coding workload from 16% OpenAI / 57% Anthropic to 52% OpenAI / 18% Anthropic.
• Replit switched after OpenAI offered more than 30% off a contract worth over $100 million annually.
• DataCamp CEO Jonathan Cornelissen reported 80–90% cost reductions; a US bank got ChatGPT seats doubled to 500 users at under $7 per seat instead of $20+.
• OpenAI cut GPT-5.6 Luna pricing by 80% on July 30, 2026, lowering input costs to $0.20/MTok.
• Anthropic launched Claude Sonnet 5 at $2/MTok input on June 30 and Claude Opus 5 at $5/MTok on July 24.

Bottom line If you're evaluating LLM vendors, lock in pricing now—this price war creates leverage for negotiation but may not last.

• SpaceX closed $40 billion in debt financing for GPUs expected to arrive in Q1-Q2 2027, with Musk citing the company's investment-grade rating and Starlink and launch revenue as enabling factors.
• Musk posted that debt markets have 'almost entirely shut off access to money' for companies lacking substantial revenue independent of AI data centers, predicting 'guppy-level death and consolidation' for 200+ neoclouds.
• A 2023 Blackstone-led $2.3 billion private credit loan to CoreWeave established the blueprint for chip-backed debt, a market now on track to reach $1 trillion.
• Blackstone executives initially asked CoreWeave leadership 'What is a GPU?' and 'Is AI real?' before proceeding with the foundational deal.

Bottom line If you rely on neocloud GPU providers, assess their capitalization and diversification now; Musk predicts widespread failures and consolidation among smaller players.

• Amazon says someone tried to exploit the vulnerabilities four days before the patches shipped, contradicting earlier assessments that mass exploitation was averted.
• Patched versions PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35 are available; Sansec reports the vulnerabilities are present in every unpatched PHP since version 5.4.
• Attackers targeted a European government entity, accessing password hashes and MFA secrets within two hours, though Palo Alto Networks later said it could not confirm the initial access used the specific PHP2Shell CVEs.
• The PHP announcement states bluntly: 'There are no complete mitigations; updating is the only safe choice.'
• The PHP Foundation operates on a shoestring budget with one full-time staff member and 14 contractors, despite PHP being used by the majority of the internet.

Bottom line If you run PHP anywhere, assume exposure and verify patches are applied immediately; the pre-patch exploitation attempts mean the disclosure window was narrower than initially believed.