AI & SaaS News, Oct 22: Claude Duet, Railway Breach

Last checked October 22, 2026 · News roundup

Today in brief: Anthropic opened a waitlist for Claude Duet, a proactive agent app that messages you first, and ChatGPT added PIN-locked chats. The bigger story for builders is security: Railway says an attacker may have read customer environment variables, a poisoned LiteLLM 1.107.0 release hit PyPI and Docker, and PHP shipped emergency fixes for two critical flaws already under attack.

If you run anything on Railway, LiteLLM or PHP, skip to the second half first. Everything below was checked against vendor posts and advisories on the morning of October 22, 2026.

AI · 4 stories

What is Claude Duet? Anthropic's new proactive agent app

Claude Duet is a separate Claude app, announced October 21, in which the agent comes to you instead of waiting for a prompt. It sends a short morning brief of what needs attention, checks your connected apps every few hours, drafts replies and follow-ups, and takes on larger jobs you send by message, such as scheduling a meeting or building a spreadsheet or deck. It runs on Claude Opus 5.5 inside its own cloud computer, so it keeps working while your laptop is closed, and it uses the memory, skills and connectors already on your Claude account.

Who can get it: US subscribers on Pro and Max, through a waitlist; Team and Enterprise are not included yet. MacRumors reports an iOS app and web access, and Anthropic's product page also lists Android. Cost: no separate fee, but its background checks count toward your plan's usage limits, so heavy use will eat into the same allowance as chat. Anthropic says Duet asks before sending messages or making payments, never sees your passwords, and, as a research preview, can still misjudge what is urgent.

If you plan to hand it third-party skills, our guide on checking a Claude skill before you install it applies here too. More agent tools sit in our AI agents and Claude Code hub.

How to lock a chat in ChatGPT, and what Locked Chats won't do

ChatGPT can now hide individual conversations behind a four-digit PIN, or Face ID and Touch ID on supported devices. OpenAI began rolling out Locked Chats on October 20 to Free, Go, Plus, Pro, Business, Enterprise and Edu accounts (not ChatGPT for Healthcare), so it may not show up for you yet. Locked conversations move to their own Locked Chats section and drop out of regular history, pinned chats and search, but unlike Temporary Chats you can come back to them later.

Read the fine print before you treat it as a vault. According to TechCrunch's summary of OpenAI's help article, locking is not end-to-end encryption, does not shorten how long chats are stored, does not erase anything ChatGPT already remembered, and does not change the "Improve the model for everyone" setting. Locked chats keep a separate memory that does not flow into ordinary chats. One warning worth knowing: if you reset the PIN, every locked chat and file behind the old PIN is permanently deleted. You also cannot lock group chats, archived chats, chats opened from a shared link, or chats with scheduled tasks or meeting recordings.

What to do: use it for screen privacy on a shared laptop or phone; for data you don't want stored at all, Temporary Chat or not pasting it in remains the safer choice.

OpenAI prompt caching now holds for 12 hours on GPT-5.6 and later

Developers on the OpenAI API can now keep a shared prompt prefix cached for at least 12 hours on GPT-5.6 and newer models, up from the default 30-minute minimum. OpenAI's developer account flagged the option this week, and the prompt caching guide now documents it: set prompt_cache_options.ttl to "12h" in the Responses API (the older prompt_cache_retention parameter does not apply to these models).

What it costs: the guide lists cache reads at 0.1 times the normal input rate (0.05 times for GPT-6.1 Sol), while writing to the cache costs 1.25 times the input rate for the 30-minute setting and 2.5 times for 12 hours. That makes the long setting worth it only when the same long context, such as a codebase summary, a product catalog or a system prompt with policies, is reused many times across a working day. For a prompt hit a few times an hour, the cheaper 30-minute write is likely the better deal.

Who it affects: teams building agents and support bots with large, stable instructions. Run the numbers on your own traffic before switching every call to 12 hours.

Anthropic's AI safety bill: a judge could halt a model if 50+ lives are at risk

Anthropic has been pitching Congress a draft federal bill that would let the government ask a court to stop a model's release. TechCrunch reported the details on October 20, after Politico broke the story on October 16, and an Anthropic spokesperson confirmed the draft. The trigger is a "foreseeable, imminent" risk of more than 50 deaths or potentially over $1 billion in property damage, tied to a biological weapon, a cyberattack or a model escaping its developer's control. Those thresholds echo California's SB 53.

The process: independent evaluators registered with the Commerce Department (labs may pay them, as long as pay does not depend on results) would have 72 hours to notify Commerce when they find such a risk, and Commerce would then ask a federal judge in Washington, D.C., to block the release. No agency could halt a model on its own authority. It is only a proposal for now; no bill number or sponsor has been reported.

Why it matters to business users: if something like this passes, a flagged model launch could be delayed by a court, which matters to anyone planning products around a vendor's next release.

SaaS & business · 5 stories

Railway security breach: rotate every environment variable now

Railway, the cloud platform many developers use to deploy apps and databases, disclosed on October 21 that an unauthorized party may have accessed encrypted customer environment variables, and for some customers obtained the decrypted contents. That can include API keys, database passwords and container registry credentials. Railway said it detected the activity that morning, believes it is part of a wider series of attacks on platform companies aimed at reaching AI inference providers, and has warned upstream providers so they can revoke keys.

All deployments were paused while the investigation runs, so you cannot ship new builds until Railway lifts the pause; follow incident QH8L8B3E on Railway's status page for updates. Railway says the impact may be limited to a subset of users and that it will email affected customers directly, but it asks everyone to act now as a precaution.

LiteLLM 1.107.0 malware: how to tell if you pulled the bad release

LiteLLM, the open-source gateway many teams use to route calls to OpenAI, Anthropic and other model APIs, had a malicious 1.107.0 release published on October 21. Security firms SafeDep, Socket and JFrog all report that the wheels carried a credential stealer that runs whenever Python starts, even if your code never imports LiteLLM. It collects SSH keys, cloud and CI/CD credentials, AI tool tokens, browser passwords and, where a database URL is set, LiteLLM's stored provider keys, then sends them out; a second component checks in hourly for new code to run.

Socket says the Docker image ghcr.io/berriai/litellm:v1.107.0 was affected too, and that around 13:14 UTC the latest, main-latest and main-stable tags pointed to the same image, so auto-updating deployments may have pulled it. SafeDep lists 1.106.2 and the two 1.107.0 release candidates as clean.

What to do: search lockfiles, build logs and running image digests for 1.107.0. If you find it, isolate the host, rebuild from a reviewed version, and rotate every credential that machine could read, from a clean environment.

PHP2Shell: which PHP version fixes CVE-2026-109618 and CVE-2026-109619

The PHP project shipped emergency releases on October 21 for two unauthenticated remote code execution flaws, nicknamed PHP2Shell, found by researchers at Calif, Wiz and OpenAI. Both come from memory left in a corrupted state when a request ends abnormally, and they affect PHP that serves web requests through PHP-FPM, Apache mod_php, php-cgi, FrankenPHP or LiteSpeed. BleepingComputer reports that the PHP team rates mod_php as the highest risk because a working exploit has been shown, and that Cloudflare is already seeing early attacks against both bugs.

Who it affects: any WordPress, WooCommerce, Laravel or custom PHP site, whether you host it yourself or not. If a managed host runs your site, check its status page or ask support whether it has patched; if you manage the server, update now and restart every PHP worker. Branches 8.1 and older no longer get official releases, so those sites need a distribution or long-term-support vendor backport, or an upgrade.

ClickUp price increase: Core now $9 per user on annual billing

ClickUp quietly raised the annual price of its Core plan from $8 to $9 per user per month, a 13% increase. Pricing tracker PricingSaaS caught the change between snapshots taken October 12 and October 19 and verified it on October 19; when we checked ClickUp's pricing page on October 22 it showed Core at $9 billed yearly against a struck-through $12. The same page also lists Business at $17 (struck-through $25) and a Max tier at $100, while a second plan grid still shows Unlimited at $7 and Business at $12, so the lineup looks mid-transition.

The AI add-ons are listed separately: Brain AI at $9 per user per month and Everything AI at $28, plus AI Super Credits sold in 10,000-credit packs. Who it affects: new buyers and teams renewing on Core. Existing subscribers should check their renewal notice rather than assume the new rate applies right away. We track moves like this one, alongside Atlassian and Copilot, in our October 2026 SaaS price change tracker.

Is Meta doing a stock split? The Class C shares and Q3 numbers, explained

Effectively, yes. With its third-quarter results on October 21, Meta's board approved a new non-voting Class C stock, effective January 19, 2027. Shareholders will get one Class C share for each Class A or Class B share they hold, which Meta expects to work like a two-for-one split on the Class A price while leaving voting power unchanged, so Mark Zuckerberg keeps control.

The quarter itself: revenue of $64.6 billion, up 26% from a year earlier, but operating income fell 37% to $12.99 billion after a $9.89 billion legal charge linked to its August settlement with state attorneys general over teen social media lawsuits. Meta narrowed 2026 capital spending, much of it for AI data centers, to $135 billion to $145 billion and guided fourth-quarter revenue to $73 billion to $76 billion. Forbes reports Zuckerberg called the Muse AI agent, which passed 10 million downloads in 40 days, one of several "major milestones."

For advertisers: nothing changes in Ads Manager today; the spending plan signals more AI features inside Meta's ad tools.

FAQ: Claude Duet, the Railway breach and PHP2Shell

Is Claude Duet free?

There is no separate charge, but you need a paid Claude Pro or Max plan in the US and a spot off the waitlist. Duet's background checks and tasks draw on the same usage limits as your regular Claude chats, so a busy Duet can leave you less room for normal use during the week.

Was my app's data leaked in the Railway breach?

Railway has not said how many accounts were hit; it says the impact may be limited to a subset of users and that it will email affected customers. Because environment variables can hold live keys, treat yours as exposed until you hear otherwise: rotate them, then watch logs and provider billing for unusual use.

Is my WordPress site affected by PHP2Shell?

Most likely, if it runs on an unpatched PHP version, since the flaws affect PHP serving web requests regardless of the app on top. Check your PHP version in your hosting panel or WordPress Site Health screen; you need 8.5.12, 8.4.27, 8.3.36 or 8.2.35 or later, or a vendor backport on older branches.

Which LiteLLM version is safe to use?

Avoid 1.107.0 entirely. Security researchers name 1.106.2 as clean, along with the 1.107.0 release candidates, and recommend pinning an exact version instead of using floating Docker tags such as latest. If 1.107.0 ever ran on a machine, rotate the secrets that machine could read.

Sources (accessed October 22, 2026): Anthropic, Claude Duet (Oct 21) · MacRumors (Oct 21) · TechCrunch, Locked Chats (Oct 20) · OpenAI prompt caching guide · TechCrunch, Anthropic bill (Oct 20) · Railway disclosure (Oct 21) · SafeDep (Oct 21) · Socket (Oct 21) · BleepingComputer, PHP2Shell (Oct 21) · PricingSaaS, ClickUp (Oct 19) · ClickUp pricing · Meta Q3 2026 results (Oct 21) · Forbes (Oct 21)