Short Stack #7Thu, Oct 22, 2026
01
AI-assisted research found two critical PHP flaws, and the patch is out
On Oct 21, PHP shipped 8.5.12, 8.4.27, 8.3.36 and 8.2.35 to fix CVE-2026-109618 and CVE-2026-109619. Under the right conditions, both let an unauthenticated attacker run code on a PHP server. The PHP Foundation credits reports from Calif, Wiz and OpenAI Codex Security, and says AI tools now help it validate a flood of incoming reports. PHP 8.1 and older get no upstream fix.
⏱ 10-MIN TRYRun php -v on every server, container image and host you or your clients use, upgrade anything below those versions, and redeploy.
Source: thephp.foundation
02
Flint is an open coding model built to run fast on your own machine
Recursive released Flint on Oct 21 under Apache 2.0: a mixture-of-experts model with 40B total parameters and 2.5B active per token. Recursive says it leads MoE models under 50B on agentic coding benchmarks and runs at 125+ tokens a second on an M4 Pro MacBook Pro (vendor claims). It works with llama.cpp, Ollama, LM Studio and vLLM, and Recursive says it needs more guidance than big closed models.
⏱ 10-MIN TRYIf you have a high-memory Mac or GPU, pull a quantized Flint build from Hugging Face into Ollama or LM Studio and give it one small, well-scoped refactor.
Source: recursive.com
03
Gemini Notebook now lets you steer slide decks and videos before they render
Google said on Oct 21 that Gemini Notebook can walk you through a step-by-step flow for Slide Decks and Video Overviews. It suggests focus topics, formats and visual styles from your sources, and a Review toggle lets you edit the outline or producer notes before the final output. Rolling out gradually to Workspace and personal Google accounts.
⏱ 10-MIN TRYDrop one product doc into Gemini Notebook, ask for a slide deck with Review outline on, and rewrite the outline before you let it render.
Source: workspaceupdates.googleblog.com
04
Stripe Treasury now lets agents like ChatGPT and Claude run your business banking
Stripe announced on Oct 21 that startups can let agents check balances, pay invoices, move money between accounts and convert currencies, via Stripe's MCP server. You pick which accounts an agent sees, whether it can read or act, and when money movement needs your approval. Card creation and agent spending limits are coming in the next few weeks.
⏱ 10-MIN TRYWrite down the three money chores you repeat weekly, then connect a read-only agent to your Stripe data and ask it for a morning balance-and-failed-payments report.
Source: stripe.com
05
Hugging Face's Carbon-X lets you chat with DNA on a laptop
Hugging Face released Carbon-X on Oct 22, an open 14B model trained on DNA and plain English, so researchers can ask what a DNA change might do to gene activity. It runs locally, so no data leaves your machine, and takes about 50,000 base pairs at a time. Its makers say it hasn't been validated in wet-lab experiments yet.
⏱ 10-MIN TRYRead the Carbon-X release on Hugging Face's HuggingFaceBio page and list one question in your field that a small, local, domain-trained model could answer.
Source: wired.com