OpenAI models can now also be used via Google Cloud, for now to a small group of business customers. And PHP urgently released updates for two serious flaws that researchers found with the help of AI models. If your website runs on WordPress, Drupal or Joomla, it is best to read the second part right away.
OpenAI models on Google Cloud
On 21 October, Google announced that three OpenAI models are coming to the Google Cloud Model Garden: GPT-6 Astra (the heaviest model, for programming, computer use and professional work), GPT-6.1 Sol (almost as good, but cheaper) and GPT-6 Luna (fast and inexpensive, for everyday work). They are currently in private preview for a selection of business customers. You can register your interest via an interest form. According to Unite.AI, OpenAI wants to make the models available to everyone within a few weeks.
You pay through the Google Cloud Marketplace. Usage appears on your regular Google Cloud invoice and counts towards existing cloud agreements. Google writes that prompts, context and output stay within your own data perimeter and are never used to train models. Zero Data Retention and Confidential Compute are coming "soon". The announcement says nothing about regions or storage in Europe, and per-token prices are not yet known either.
What does this mean for you? If your organisation already works with Google Cloud, you will soon be able to use GPT models without a separate contract with OpenAI. Your data processing agreements then run through Google. Do check in which region the models run before you put personal data into them, as that is not yet stated anywhere. You can see how ChatGPT and Gemini score on privacy at /chatgpt/, /gemini/ and /veiligheid/.
PHP2Shell: two critical flaws, found with AI
On 21 October, the PHP project released emergency updates for two flaws, together called PHP2Shell (CVE-2026-109618 and CVE-2026-109619). Through these flaws, an attacker without an account can run code on your web server. They are scored 9.2 out of 10, and every PHP version from 5.4 onwards has at least one of the two flaws. The flaw sits in PHP itself and therefore applies to every common setup: PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed.
Security company Wiz found the flaws together with Calif and OpenAI. Wiz used AI models in doing so, including models from OpenAI and Google. According to Wiz, those models made it much easier to turn a decade-old problem into a working attack. Details leaked a day before the planned disclosure. According to BleepingComputer, Cloudflare already saw attack attempts before the updates were out. The UK's NCSC advises updating immediately or taking systems offline.
What does this mean for you? Update to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35. If you run an older version (8.1 or lower), the PHP project no longer provides updates for it. Then ask your hosting provider what they are doing, or switch. If you have a webshop or customer portal, these flaws could leak passwords, tokens and API keys from memory. If you suffer a breach, you may have to report it to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) within 72 hours. This mainly affects e-commerce, software development and marketing, where a lot runs on WordPress.
In brief
- GPT-6 Astra, Sol and Luna are coming to Google Cloud. For now only in preview, and nothing is yet known about regions in Europe.
- Update PHP today. Attacks are already being attempted.
- AI helps defenders find flaws. Attackers have the same help, so keep up with your updates.
All models side by side: /modellen/.