Blog

The iPhone folds, Tesla's robots clock in, and every PHP server needs a patch

apple phones tesla spacex security unifi

Earnings season, a brand new iPhone shape, and a security bug in the engine under most of the web. One post wasn't going to cover it, so here's the roundup.

The iPhone Duo is here, and it's very much a version one

Apple's first foldable went on sale in stores on Friday, October 23 [1]. The reviews landed earlier in the week, and they mostly agree on the shape of it: a 5.4-inch outer screen, a 7.6-inch matte inner screen that does a good job hiding the crease, and a price of $1,999 [2][3].

The trade-offs are real. There's no Face ID (Touch ID lives in the side button) and no telephoto camera [3]. The Verge also found the outer screen too small to live on, so you end up flipping it open constantly [2]. Their summary was blunt: "It is expensive, it's full of compromises, and it can be incredibly frustrating to use." [2] Even 9to5Mac, which came away convinced foldables are the future of the iPhone, said "For most people, a traditional iPhone is still the practical purchase right now." [3]

Heat came up a lot. In one 30-minute gaming test, the Duo hit 46.5°C versus 43.8°C for the iPhone 18 Pro, with a 20 percent lower frame rate [4]. Other reviewers found it just warm [4].

My take: if you love gadgets and like being early, you'll probably have fun with it. If you want a phone that just works on day one, wait for the apps to catch up, and maybe for version two. First-generation Apple products have a habit of getting a lot better the second time around.

Tesla's robots are on the line, and profit took the hit

Tesla started production of its Optimus humanoid robot at its Fremont factory, in space that used to build cars [5]. Elon Musk called it "early production" and said the ramp will be "somewhat bumpy because it is such a radically new product." [5] He still claimed Tesla can build 20,000 robots a week by the end of 2027 [5].

The quarter itself was less exciting. Revenue was $28.04 billion, roughly flat, while net income fell 43% to $787 million as spending on AI and Optimus climbed [5]. Tesla delivered 486,532 vehicles [5]. The bright spot was services, which includes Full Self-Driving subscriptions: up 33% to $4.6 billion [5].

If you own a Tesla and are waiting for unsupervised FSD, the date moved again. Tesla's Ashok Elluswamy said "We suspect somewhere around Q2 next year is when we can turn on some of the first customer vehicles to be part of the robotaxi fleet." [5] I'd treat that as a goal, not a promise, and budget for it that way.

SpaceX wants to catch the whole rocket next month

On its own Q3 earnings call, SpaceX said Flight 15, expected next month, will try to catch both the Super Heavy booster and the Ship upper stage with the launch tower [6][7]. Boosters have been caught three times in 14 flights, but no one has caught a Ship yet [6]. Musk's confidence level: "I'd say it's more likely than not that this succeeds next flight." [6] The flight still needs regulatory approval [7].

The money side is growing fast. SpaceX reported $14.6 billion in Q3 revenue, up 161%, and $4.4 billion in net income [6]. Only $1.8 billion of that came from launches; most came from Starlink and AI [6]. In other words, the rockets are increasingly the delivery truck for the real business.

PHP2Shell: if you run a website, patch PHP this week

This is the one with homework. Two critical PHP bugs, CVE-2026-109618 and CVE-2026-109619, nicknamed PHP2Shell, allow unauthenticated remote code execution [8]. CISA says they "affect all PHP installations serving web requests" and wants organizations to update immediately [8]. The fixed versions are 8.5.12, 8.4.27, 8.3.36 and 8.2.35 [9].

The details make it worse. The bugs reach back to PHP 5.4, they can also leak memory holding credentials and API keys, and they apply to PHP-FPM, Apache with mod_php, and other common setups [9]. Details leaked before the planned disclosure date, so the PHP Foundation pushed the fixes out a day early, and attack attempts were already hitting sensors around the release [9]. Amazon reported seeing attempts four days before the patches shipped [9].

There's an AI twist too. Wiz, OpenAI and Calif found the issues, and the reporting credits frontier AI models with helping turn an old, unproven memory bug into a working exploit [9]. That's the double edge of AI in security: it helps defenders find decades-old flaws, and it means attackers can move faster on them.

What to do:

  • If you have a WordPress, Drupal or any PHP site, ask your host or check your control panel for the PHP version, and get onto a fixed release.
  • If you manage your own servers, update PHP, restart PHP-FPM or Apache so the new version actually loads, and confirm the version afterward.
  • Check your logs for anything odd from the past week, since attempts started before the patches existed [9].

Plex owners: same week, same lesson

CISA also added four Plex Media Server flaws, chained together as Plex2Shell, to its list of actively exploited bugs [10]. Chained, they can grab the owner's admin token and run code [10]. Exploitation reports started October 17, initially against honeypots to drop a cryptominer [10]. The fix shipped back in August, in version 1.43.3.10861 [10]. If your Plex server is reachable from the internet and you've been putting off updates, this is your sign.

UniFi quick hit

A quieter week for Ubiquiti, but one update worth noticing if you have UniFi Protect SuperLink smoke and CO alarms: new firmware released October 22 fixes an issue where trouble alerts could stay silenced after the silence period ended, plus a battery drain bug [11]. Life safety devices are the one place I don't wait on updates. The Network 11.0.94 release candidate is also rolling out gradually with Thread and WiFi Uplink fixes [11]; that one I'd leave for the official release unless you like testing.

The takeaway

New hardware is fun, and this week had plenty. But the story most likely to affect you is the boring one: a patch for software you may not even know you're running. Check your site, check your Plex, then go read the foldable reviews.

Sources

  1. Apple Newsroom, iPhone Duo arrives at Apple Store locations worldwide (October 22, 2026)
  2. The Verge, The iPhone Duo is a messy, expensive, good time (October 21, 2026)
  3. 9to5Mac, iPhone Duo review: The future is foldable (October 21, 2026)
  4. MacRumors, Does the iPhone Duo Run Hot? Here's What Reviews Found (October 21, 2026)
  5. TechCrunch, Tesla starts Optimus robot production in California as profit falls 43% (October 21, 2026)
  6. Space.com, SpaceX will attempt 1st-ever double Starship rocket catch on next test launch (October 20, 2026)
  7. SpaceNews, SpaceX plans Starship upper stage catch on next launch (October 20, 2026)
  8. CISA, Critical Vulnerabilities in PHP Require Immediate Patching (October 21, 2026)
  9. SecurityWeek, PHP2Shell Patches Land as First Exploitation Attempts Hit Sensors (October 21, 2026)
  10. BleepingComputer, CISA: Hackers chain Plex flaws in Plex2Shell attacks to breach servers (October 21, 2026)
  11. Releasebot, Ubiquiti Release Notes (October 2026)

← All posts · Questions? Get in touch