AI helped crack open a decade-old flaw under most of the web, ASIC warned about 'big fakes', and Western Sydney switched on thousands of new GPUs. Here's what Australian business owners should actually do this week, and what to ignore.
AI helped crack open a decade-old flaw under most of the web, ASIC warned about 'big fakes', and Western Sydney switched on thousands of new GPUs. Here's what Australian business owners should actually do this week, and what to ignore.
Most weeks, AI news is a parade of launches, benchmarks and CEOs saying the future is very close. You can skip most of it.
This week was different. One story needs you to pick up the phone today. A couple of others will shape how Australian businesses buy and use AI over the next year. The rest is interesting, but you can let it go to voicemail.
We run an AI automation agency out of the Sydney CBD, so we read this stuff so you don't have to. Here's our take on 16 to 23 October 2026, story by story.
On 21 October, security firm Wiz published details of two critical flaws in PHP itself, the programming language underneath WordPress, Drupal, Joomla and a huge chunk of the internet. Wiz says PHP powers about 70% of websites. The PHP security team rated both bugs 9.2 out of 10 for severity, and Wiz says every PHP version going back to 5.4 is hit by at least one of them.
Here's the AI angle, and it's the bit worth sitting with. The flawed code had been sitting there for more than a decade. What changed was that frontier models (Wiz used Gemini 4 Argon and GPT-5.6 Sol, alongside its own tooling) made it practical to chain the bugs into working attacks. Wiz says the models let its team build and adapt exploits across multiple applications in hours. Its blunt conclusion: complexity may no longer be a meaningful barrier.
The Australian Signals Directorate's ACSC issued a "Critical Alert: Act Now" on Wednesday afternoon, ahead of the patch release at 1am AEDT on Thursday 22 October. Fixed versions are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. According to Tenable's write-up, Amazon Threat Intelligence saw an exploitation attempt on 17 October, four days before disclosure, and says the bug is now being broadly exploited.
What to do: If your business has a WordPress site, a WooCommerce store or a client portal, email whoever hosts or manages it today. Ask two questions: which PHP version are we on, and has the patch been applied and the PHP workers restarted? Get the answer in writing. If you're on PHP 8.1 or older, the US cyber agency CISA recommends taking the site offline until it's updated. Cloudflare's firewall rules help, but Cloudflare itself calls them a stopgap. Amazon recommends starting any investigation from 17 October, not from the disclosure date.
We'll be honest. Plenty of AI hype is overblown. This one isn't. The cost of finding and weaponising old bugs just dropped, and that hits the small business in Penrith running a five-year-old WordPress theme far harder than the big banks.
On Tuesday 20 October, the federal parliamentary inquiry into AI sat in Sydney. ASIC's executive director of enforcement and compliance, Chris Savundra, told it that AI was creating risks in finance across advertising, complaint handling and credit scoring, plus cyber threats to financial systems. He said scammers were using "big fakes" and more sophisticated methods on Australian consumers, and that younger Australians were increasingly leaning on AI for financial advice. He called for the government's new unfair trading practices scheme to be extended to financial services.
eSafety Commissioner Julie Inman Grant was less diplomatic. "We've run this experiment before," she told the committee, comparing AI to the years regulators spent catching up on social media harms.
What to do: Two things. First, assume a voice on the phone or a face on a video call can be faked. Put a simple rule in place: any change to bank details, any urgent payment request, any "the director needs this today" gets verified by calling back on a number you already have. Not the number in the email. It costs nothing and blocks a depressing amount of fraud.
Second, if you're a mortgage broker, financial planner or lender using AI anywhere near credit decisions, advertising or complaints, ASIC has just told you where it's looking. Document how the tool works and who checks its output.
According to Forbes Australia, OpenAI told the inquiry in documents tabled on Tuesday that it would "potentially" pay into a fund for Australian creators whose work trains its models. The catch is a long list of conditions: scope, opt-out rules, total fees and legal certainty, all of which "would have to be competitive with other jurisdictions, particularly the US."
The subtext is data centres. Both OpenAI and Anthropic have flagged interest in spending billions on Australian infrastructure, and OpenAI has said copyright is the real gating question. Forbes notes OpenAI's December MOU with NextDC over a planned $7 billion Sydney campus is non-binding. It also reports OpenAI's Australian entity booked $3.86 million in revenue between 14 May and 31 December 2025, with Commonwealth Bank, Coles and Virgin named among its local enterprise customers.
What to do: For most Aussie SMBs, nothing yet. The committee's final report is due by 30 November, so this will run for months. If you're a publisher, photographer, agency or anyone whose content is the product, though, pay attention. The rules decided here will set what your work is worth to AI companies. Our view: "potentially, if it's cheaper than America" is a negotiating position. Read it that way.
On 19 October, GreenSquare announced the first stage of its SYD1 data centre at Norwest Business Park in Western Sydney is operational. Its first customer, Sharon AI, will deploy about 8,200 NVIDIA Blackwell Ultra GPUs there. It's a 1995 building rebuilt in eight months rather than knocked down, and the NSW Investment Delivery Authority has endorsed support for a proposed 80 MW second stage.
Not every project is cruising. The ABC reported on 21 October that Firmus, which recently abandoned its ASX listing plan, has not secured full funding for its Long Reach AI data centre in northern Tasmania.
What to do: If you're a regulated business, this is good news, with an asterisk. More serious compute on Australian soil makes it easier to run private AI where your data never leaves the country. That matters for an accounting firm in Parramatta, a medical practice in Chatswood or a law firm in North Sydney. But "hosted in Australia" and "governed under Australian rules" are two different promises. When a vendor tells you their AI is local, ask where prompts are processed, where logs are stored, who holds the encryption keys and whether any of it is used for training. Get it in the contract.
Also on 21 October, Google Cloud announced OpenAI's GPT-6 Astra, GPT-6.1 Sol and GPT-6 Luna in its model garden, rolling out in private preview to select enterprise customers. Google says customer prompts and outputs stay within the customer's data perimeter and aren't used to train foundation models.
What to do: Ignore the enterprise sales pitch. Keep the lesson. Models from rival labs are now sold side by side, and the "best" model changes every few months. If you're building automations in Make, Zapier or n8n, keep the AI model as one swappable step in the workflow. At AI Lab we've seen too many businesses rebuild a workflow from scratch because it was hard-wired to one provider. Don't marry a model. Date it.
Anthropic opened a waitlisted research preview of Claude Duet on 21 October, an app where Claude acts as a proactive agent. Anthropic says it's built for "professionals and small business owners", sends a morning brief, checks your connected apps every few hours, and works in the background. Before it sends a message, makes a payment, signs a document or deletes anything, it shows you what it's about to do and waits for approval. Some things, like trading securities or moving money between accounts, are off-limits even with approval.
What to do: Don't rush. It's US-only for now, limited to Pro and Max subscribers, and the launch examples lean on American tools like QuickBooks and Gusto rather than the Xero and MYOB stacks most Australian businesses run. Anthropic also admits it "might misread a thread or miscalibrate what's urgent".
The useful move is preparation. An agent is only as good as the inbox, calendar and CRM it reads. If your client records live in three spreadsheets and someone's head, fix that first. Then decide what any agent may do alone and what needs a human tick.
Recursive, led by former Salesforce chief scientist Richard Socher, released Flint on 21 October. It's a free, open coding model under the Apache 2.0 licence that runs on a laptop. TechCrunch reports it uses 2.5 billion of its 40 billion parameters at a time and, in Recursive's own tests, hit about 131 tokens per second on an M4 Pro MacBook Pro.
What to do: Unless you have developers, ignore the model. Watch the trend. Small models running privately on your own hardware keep getting more capable, and that's exactly what regulated firms want: no data leaving the building. The benchmark claims are Recursive's own, and it admits Flint needs more hand-holding than paid coding assistants.
AI Lab Australia works with businesses across Sydney, from the CBD to Parramatta and the Northern Beaches, on AI strategy, custom chatbots and voice agents, workflow automation with Xero, MYOB and your CRM, team training, and Australia-hosted private AI for regulated firms. If any of this week's news has you wondering where to start, drop us a line at info@ailabaustralia.com or visit ailabaustralia.com. We'll give you a straight answer, even if it's "you don't need AI for that."
Get expert guidance on implementing ai news solutions for your Australian business
