Daily Brief — October 30, 2026

• Claude writes approximately 90% of Claude Code itself, according to Anthropic's engineering team.
• A documented pull request ran more than fifty review rounds overnight.
• Reviewers spent most of their effort on pre-existing code rather than new changes.
• The team's monorepo grew from roughly 2,500 merged changes per day in May to more than 30,000 in September, prompting Anthropic to replace git with an in-house system.
• The team acknowledges they lack a control they say they do not yet have.

Bottom line Read the Anthropic post if you're weighing how far to let AI write your own codebase, but treat the no-mental-model claim as a hypothesis, not a prescription.

• Search was 49.7% of Alphabet's $128B Q3 2026 revenue, down from 62% in early 2019, while Google Cloud grew from 4.4% to 24.1% over the same period.
• Search revenue grew 12% year over year to $63.4B, missing the 15% analysts expected, while Google Cloud revenue jumped 103% to $30.7B.
• Management acknowledged that the fast-growing AI mode brings in less revenue than traditional search, and Google is expanding its AI mode ad program internationally.
• Alphabet reported negative free cash flow of $9.07B for Q3, compared to the $2.7B analysts expected, with capital spending at $51.4B in the quarter alone.
• Alphabet shares dropped 13% on Thursday, the worst day since going public in 2004, surpassing the previous record decline of 11.63% set in March 2020.

Bottom line If you rely on Google for acquisition or ads, monitor how AI mode monetization evolves as the revenue-per-query gap could reshape search economics.

• CVE-2026-98432 is a race condition in the Linux kernel's IPv4 TCP connection setup that can cause the kernel to read freed memory, rated 9.8 CVSS by the kernel's own CVE team.
• Anthropic said on October 27 that its AI model wrote an exploit that achieves remote root code execution on Linux servers with a Multipath TCP listener, requiring no credentials.
• Ubuntu and Red Hat Enterprise Linux had not released a fixed kernel as of October 29.
• Red Hat, Amazon, Oracle, and SUSE assign the flaw CVSS scores between 5.9 and 8.1, lower than the kernel team's 9.8 rating.
• Caveat: The demonstrated exploit requires an MPTCP listener, which must be explicitly requested by an application; neither the CVE record nor the kernel fix mentions MPTCP.

Bottom line Patch Linux servers with MPTCP listeners immediately; others should prioritize based on your vendor's severity assessment and patch timeline.

• Palo Alto Networks confirmed active exploitation targeting internet-exposed PAN-OS management interfaces and is releasing fixed versions across affected branches, with Unit 42 independently verifying the attacker's tooling and results.
• The exploited surface is the PAN-OS management web server, which also fronts the GlobalProtect portal, allowing attackers to leverage PHP2Shell for unauthenticated remote code execution.
• CISA added CVE-2026-109618 and CVE-2026-109619 to its Known Exploited Vulnerabilities catalog on October 26, confirming active exploitation and ordering federal civilian agencies to patch within three days.
• A suspected China-nexus threat actor observed on October 25 combined PHP2Shell with a Linux kernel privilege escalation vulnerability tracked as Fragnesia to root 25 servers across the U.S., Japan, Taiwan, and South Korea.
• After rooting the firewalls, the attacker launched attacks against Active Directory with confirmed credential extraction and directory enumeration.
• Patched versions PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35 are available; Sansec reports the vulnerabilities are present in every unpatched PHP since version 5.4.

Bottom line With a major firewall vendor confirming active exploitation of its management interfaces and releasing emergency fixes, this is now a critical perimeter security incident; patch PAN-OS immediately, restrict management interface exposure, and audit Active Directory for indicators of compromise.