gm.
here's what happened since monday.
the 3
1. a critical PHP flaw just exposed up to 70% of websites.
on tuesday, developers released emergency patches for two critical flaws in PHP, the programming language behind an estimated 70% of websites. think WordPress sites, shopping carts, and login systems. the flaws (called "PHP2Shell") let attackers run their own code on a web server without needing any login credentials. once inside, they can hijack the site, steal user data, or install malware.
the discovery: a security researcher used an openAI model (GPT-5.6) to scan PHP's code and found a flaw that had been sitting there for years. developers originally planned to release the patch on october 22. after vulnerability details leaked publicly on hacker news, they moved the fix up by a day.
the catch: the fix exists, but every website or company running PHP has to apply it to their own servers. anyone who doesn't update is still exposed. that's why the warnings are everywhere. US cybersecurity agencies urged organizations to patch immediately. finland temporarily shut down parts of its internet services as a precaution. cloudflare deployed automatic protections to defend sites that haven't patched yet.
2. SpaceX just posted its first profit as a public company.
on monday, SpaceX reported Q3 2026 earnings with $14.6 billion in revenue, up 161% from a year earlier. net profit was $4.4 billion. in the same quarter last year, the company lost $1.1 billion. the stock rose 10% on the news.
what's driving it: SpaceX's superintelligence (SI) segment, its AI business, brought in $7.6 billion for the quarter. that makes AI SpaceX's biggest revenue line, more than starlink and spaceflight combined.
on the earnings call, elon musk said he expects SpaceX's annual revenue to land between $500 billion and $1 trillion by the end of 2027. he also confirmed that tesla and SpaceX have each formed special committees to study a potential merger. musk, who runs both companies, is sitting out the merger talks (he can't negotiate with himself).
3. larry ellison borrowed billions against his tesla, SpaceX, and skydance stock to help his son buy warner bros.
on monday, the WSJ reported that larry ellison (oracle founder) pledged shares in oracle, tesla, SpaceX, and paramount skydance as collateral to help finance his son david's $110 billion warner bros deal. the deal closed october 6. the new company is called skydance.
ellison lined up expanded credit from citigroup, HSBC, JPMorgan, UBS, and BNP paribas. the stock pledges came to light through california filings that lenders are required to make when claiming collateral. ellison had planned over the summer to sell $7.5 billion of oracle stock to help fund the deal but scrapped that plan in september and shifted to borrowing instead.
for context: ellison previously signed a personal guarantee for $40.4 billion of his son's deal. that means if the deal ever goes bad, his own assets are on the line, and he can't back out. his net worth is roughly $300 billion.
one more quick thing
$963,000 in trading cards were stolen from a FedEx truck outside PSA.
on october 13, thieves broke into a FedEx truck parked outside PSA's HQ in santa ana, california. the driver had left it unattended for 60-90 minutes. they took three pallets of already graded cards being shipped back to customers. the first two pallets were worth about $963,000. PSA is still valuing the third. collectors on X say the real total is in the mid 7 figures. one card alone, a rare one piece card featuring the character zoro in the top possible grade (PSA 10), was reportedly worth $500,000. PSA has deactivated the certification numbers on the stolen cards, which should make them harder to resell. compensation to affected collectors is capped at the insurance levels they chose at checkout.
see you monday.
want the Higher Watchlist?
refer 3 friends to unlock our monthly rundown of the coins and narratives on our radar.
not financial advice. aggregated community trends and commentary.