Good morning. It’s Thursday, October 22.
A New Mexico judge ordered Meta to pay $25 billion over the Cambridge Analytica scandal, the largest penalty of its kind the company has faced. Meta says it will appeal, arguing the ruling makes it nearly impossible to do business in the state.
Today we are covering:
Meta ordered to pay $25 billion in New Mexico over the Cambridge Analytica scandal
Pentagon quietly builds a Technology Support Office to covertly disrupt foreign tech programs
Hackers hit two critical PHP flaws days before the patch, with attempts climbing into the millions
Meta beats Q3 estimates with $64.6 billion in revenue as Muse tops 10 million accounts
Apple adds a Made for iPhone Duo badge to the App Store ahead of launch
Let’s dive in
Meta ordered to pay $25 billion penalty in New Mexico Cambridge Analytica case
By Jonathan Vanian via CNBC
A New Mexico judge ordered Meta to pay $25 billion for violating the state’s consumer protection laws. The state had asked for between $35 billion and $45 billion, and the money will go to New Mexico’s education fund.
The ruling follows a September jury verdict that found Meta liable for more than 43 million violations for misleading Facebook users about privacy and content moderation. The case centers on a personality quiz app that collected data from about 87 million profiles, which was then sold to Cambridge Analytica.
Meta says it will appeal, and its chief legal officer, C.J. Mahoney, argued the approach “makes it all but impossible to do business in the state.” Attorney General Raúl Torrez called it one of the largest state verdicts ever against the company.
𝕏: Ka-boom. As I’ve been saying and dissecting for the last eight years, there is a lot more there there. Every settlement has been in part due to the increase in temperature when you get to the top of Meta and its board. Good on New Mexico. - Jason Kint (@jason_kint)
The Pentagon is quietly building an elite new tech sabotage agency
By John Sakellariadis, Jack Detsch and Paul McLeary via Politico
The Pentagon has created a Technology Support Office to covertly disrupt and sabotage foreign technology programs seen as threats to U.S. military superiority. Deputy Defense Secretary Steve Feinberg signed the memo establishing it on April 14.
It was built by reorganizing two classified intelligence programs that have run similar efforts since 2023. Its tools reportedly include custom hacking capabilities and deception operations meant to trick adversaries into installing faulty components in weapons platforms.
The budget is not public, but a former official estimates its classified contracting could top $1.5 billion. Critics worry about secrecy, thin congressional briefings, and Feinberg’s former private equity firm’s defense investments, while the Pentagon calls the conflict concerns “a baseless, completely recycled narrative.”
𝕏: New: I got a tip a little while ago about a shadowy Pentagon entity called “TSO” with a lot of money and a desire for offensive hacking tools. Turns out TSO is a new DoD agency. And it does a lot more than hacking. - John Sakellariadis (@johnnysaks130)
The best way to reach new readers is through word of mouth. If you click THIS LINK in your inbox, it’ll create an easy-to-send pre-written email you can just fire off to some friends.
Hackers Exploited the PHP Vulnerabilities Days Before They Were Patched
By Lily Hay Newman via Wired
Attackers went after two critical PHP flaws, nicknamed PHP2Shell (CVE-2026-109618 and CVE-2026-109619), before patches were available. Amazon spotted an attempt on its honeypot on October 17, four days before disclosure, and details leaked publicly on October 20.
The bugs allow remote code execution without a login on PHP versions going back about a decade, and PHP runs nearly 70% of sites whose server language is known, including WordPress, Drupal and Joomla. Fixes landed in PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12.
Cloudflare CEO Matthew Prince said the company saw thousands of attempts in the 10 hours before disclosure, rising to millions soon after. PHP 8.1 and older get no official patch, and it is still unclear whether any attempts succeeded.
𝕏: Fascinating. Amazon says it has telemetry showing PHP2Shell was being exploited on Oct. 17—that is, four days prior to public disclosure. Not known who was doing it. “It remains unclear how the actor acquired exploit information prior to disclosure.” - Dustin Volz (@dnvolz)
Meta CEO Mark Zuckerberg says 10 million people have set up a Muse AI agent
By Natalie Musumeci via Business Insider
Meta reported third-quarter revenue of $64.6 billion, up 26% and above the $63.34 billion analysts expected. Net income was $9.86 billion, or $3.83 per share, after a $9.89 billion charge tied to a legal settlement.
Mark Zuckerberg said more than 10 million people in the U.S. and Canada have set up accounts for Muse, Meta’s personal AI agent launched in August. Meta also introduced Muse Wonder, which it calls its first frontier model.
Meta forecast fourth-quarter revenue of $73 billion to $76 billion, a midpoint above the $73.65 billion analysts expected. Its apps averaged 3.64 billion daily users, headcount fell 15% to 66,775, and shares rose 2.9% after hours.
𝕏: Muse, the most expensive toy ever by Meta (and some smart people may ask why it reminds of Manus AI), is draining all of Meta’s compute, and they are gonna get more. The problem? Many who downloaded it and tried it have already abandoned it. There is no clear visibility on user retention for this. - Kakashii (@kakashiii111)
Apple will label apps that are “Made for iPhone Duo”
By Emma Roth via The Verge
Apple will add a Made for iPhone Duo badge to App Store product pages for apps optimized for its foldable, and plans curated collections of iPhone Duo apps and games. The badge arrives a day before the device goes on sale on October 23.
Apps fall into tiers: those built for the foldable, apps optimized for iOS 27 that adapt automatically on the inner screen, and regular iPhone apps that behave like iPhone apps on an iPad. Netflix, Prime Video, Word, Outlook, Zoom, Slack, Salesforce and Fantastical are highlighted for the best experience, though optimized apps are a minority at launch.
The iPhone Duo starts at $1,999, and Apple says it is sold out through the end of January. Susan Prescott, Apple’s vice president of Worldwide Developer Relations, said developers are “reimagining what their apps can do.”
𝕏: The iPhone Duo reviews are some of the most brutal I’ve seen from an Apple product in a long time (Vision Pro aside). But I’ve been around long enough to remember the iPhone 5, iPhone 6 Plus and iPhone X. The app optimization issue is a non-issue and will be resolved in weeks. - Mark Gurman (@markgurman)
Trending in AI
Today’s big AI theme: AI agents are getting real jobs, from proactive assistants and online shopping to lab research.
Hugging Face’s New AI Biology Model Lets Users Chat With DNA
While Amazon blocks AI agents, Walmart rolls out the welcome mat
Thanks for reading to the bottom and soaking in our Newslit Daily, fueled with highlights for your morning.
I hope you found it interesting and, needless to say, if you have any questions or feedback, let me know by hitting reply.
Take care and see you tomorrow!
How was today’s email?
