Tech News, October 27: Meta’s $95B AI Raise, Australia’s AI Threat Warning, and Two Patch Deadlines

Monday was a day of very large numbers and very short deadlines. Meta and SpaceX lined up roughly $135 billion in combined AI financing, Australia’s cyber agency said AI-driven attacks are now scaling faster than defenders can track, and two separate patch stories landed on the same day: CISA gave federal agencies until October 29 to fix two exploited PHP flaws, and Palo Alto Networks confirmed a critical Brotli flaw in its firewalls. The funding shows how expensive the AI buildout has become; the warnings show what happens when the same technology is turned the other way.

Meta plans up to $95 billion; SpaceX leases $40 billion in AI chips

Meta said on October 26 that it had launched public offerings of about $35 billion in common and convertible preferred stock to fund its AI expansion, and filed a separate at-the-market programme to sell up to $60 billion in non-voting shares. Together, the two moves could raise up to $95 billion, which Reuters described as Meta’s largest-ever equity fundraising. The money is for the same problem every large AI lab now faces: training and running frontier models requires data centres, chips, and power at a scale that operating cash flow alone no longer covers comfortably.

SpaceX disclosed a separate deal the same day: an entity managed by Apollo Global Management will buy AI chips and server hardware and lease them to SpaceX, with total principal payments of about $40 billion. Each lease runs a little over 5 years from the day the equipment arrives, with leases expected to start in the first half of 2027 and the master lease to be finalised before the end of 2026. The hardware includes Nvidia’s Vera Rubin GPUs, which Nvidia began rolling out in the second half of 2026. SpaceX absorbed xAI in February, and its AI business now sits alongside Starlink and launch revenue as a major source of income.

Anthropic also filed for a US initial public offering on October 26, according to Reuters, making it the third large AI financing event of the day. Why it matters: these are not three unrelated announcements. Taken together, they show the AI industry moving from venture-scale funding to capital-markets-scale funding, with equity raises, private-credit leases, and public listings all being used at once. That also raises the stakes for returns: when a single day’s financing runs into nine figures of billions, investors will expect the revenue to follow, and the October 26 draft note from Apollo arguing that AI has so far shown no payoff outside tech will get tested against real earnings, not just adoption figures.

Australia: AI is now the defining force in cyber threats

The Australian Signals Directorate warned on October 27 that artificial intelligence poses an “unprecedented” threat as foreign governments use it to hack networks and critical infrastructure. In its annual cyber threat report, the directorate said AI had been “the defining force in the cyber threat landscape over the past year, allowing malicious actors to find vulnerabilities faster and exploit them at unprecedented scale, speed and sophistication.” The report also flagged a newer risk: “in recent weeks, new threats have emerged from the unintended actions of AI agents and model testing.”

The numbers behind the warning are stark. The directorate issued more than 4,400 warnings about potentially malicious activity over the past year, an 80% increase on the prior 12 months. State-sponsored actors continued to target Australian organisations, primarily to gain access to sensitive or non-public information, and that activity extends beyond government networks to critical infrastructure, private businesses, and individuals. The report said hackers linked to China, Russia, and North Korea had targeted Australia or its allies in recent times. Defence minister Richard Marles urged Australians to update their computers and “harden their systems,” adding: “Malicious actors are using AI to find vulnerabilities in systems.”

Why it matters: this is a national cyber agency putting a number on a trend that has, until now, mostly been described in adjectives. An 80% jump in warnings does not by itself prove that AI caused every extra incident, and the directorate’s report does not claim that. But the combination of a rising warning count, explicit attribution to state-linked actors, and a specific warning about unintended agent behaviour gives defenders a clearer picture than “AI is a risk” alone: the threat is both deliberate, from actors using AI to find flaws faster, and accidental, from agents acting in ways their operators did not intend.

CISA: fix the PHP flaws by October 29, or take the servers offline

CISA added two PHP vulnerabilities to its Known Exploited Vulnerabilities catalog on October 26, with a remediation deadline of October 29 for federal civilian agencies. The flaws, CVE-2026-109618 and CVE-2026-109619, both carry a CVSS 4.0 base score of 9.2 and allow an attacker with no account to run code on servers that use PHP to answer web requests. The PHP Group released fixed versions on October 21: PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. PHP 8.1 and earlier receive no further project patches.

The practical guidance is unusually blunt. CISA’s updated alert directs organisations that cannot update immediately, or that still run unsupported versions, to take their PHP-based systems offline until they can be patched. Attack complexity is high and success depends on particular worker and memory configurations, with Apache using the mod_php module rated the highest-risk deployment. But the KEV listing means the flaws are not theoretical: they are listed as known to be exploited, so the question for administrators is not whether to patch, but how quickly, and whether to check for prior compromise while patching.

Why it matters: this is the enforcement step that follows the October 21 emergency PHP release and the wave of exploitation reported last week. A KEV deadline turns a vendor patch into a dated obligation, and the “take it offline” instruction removes the usual middle ground of waiting for a maintenance window. For anyone running a public PHP site, the check is short: what PHP version is actually serving requests, is it on the fixed list, and if it is not, is the site still exposed while you decide?

Palo Alto confirms a critical Brotli flaw in PAN-OS

Palo Alto Networks confirmed on October 26 that CVE-2026-111497, a critical Brotli decoder flaw, affects PAN-OS 12.2, 12.1, and 11.2, as well as the Prisma Cloud Application Security Transporter Client. The flaw is a buffer overflow in the Brotli decoder, scored CVSS 9.2, affecting Google Brotli versions 1.0.3 through 1.2.0. Patched Brotli versions are 1.0.10, 1.1.1, and 1.2.1. PAN-OS 11.1 and 10.2 are not affected, according to the advisory. Palo Alto has not reported confirmed exploitation of this flaw.

The same flaw reaches beyond firewalls. Node.js fixed it in releases 22.23.4, 24.22.1, and 26.12.1, and PHP released rebuilt Windows packages on October 26 incorporating Brotli 1.2.1. That spread is the point: Brotli is a shared compression library used across the web, including in HTTP-based applications, so a single decoder bug becomes a patching task in every product that bundles it. Administrators should check the installed package, not just the headline version number, because a rebuilt package can carry the fix without changing the runtime version shown.

Why it matters: this is the second round of emergency patching in a week for many of the same teams, coming days after the PHP flaws above. It also shows why shared libraries are a weak point: one flaw, disclosed once, has to be fixed separately in each downstream product, on each product’s own schedule. The teams that fare best are the ones that can inventory where Brotli is bundled, rather than discovering it product by product as advisories arrive.

At a glance

Key takeaways

• Meta could raise up to $95 billion and SpaceX leased about $40 billion in AI hardware on the same day, showing AI funding has moved to capital-markets scale.
• Australia’s cyber agency issued more than 4,400 warnings in a year, up 80%, and named AI as the defining force in the threat landscape.
• CISA’s PHP deadline is October 29: patch to a fixed PHP release, check for prior compromise, or take exposed systems offline.
• The Brotli flaw (CVE-2026-111497, CVSS 9.2) affects PAN-OS, Node.js, and PHP packages alike, so inventory every bundled copy, not just one product.
• The common thread is scale: AI is scaling both the money going in and the speed at which flaws are found and exploited.

References

• Meta launches $35 billion stock offering to fund AI expansion — Reuters
• AI capital race sprints into winnowing phase — Reuters
• SpaceX enters $40 billion deal with Apollo for AI chip financing — Reuters
• Australia warns of ‘unprecedented’ AI threat — Free Malaysia Today
• CISA Lists Two Critical PHP Flaws as Exploited, Federal Deadline Set for October 29 — SSJ News
• PAN-OS Brotli Vulnerability Brings Buffer Overflow Risk — SecurityOnline