Skip to content

Charles Hill

Data & AI Governance Weekly — Week of October 19–25, 2026

This week in brief

This week was marked by lawsuits, exploitations, and DeepSeek being banned from US Federal Government systems.  With all the chaos this week, make sure to check out the ‘What this means for your organization’ section for actions you can take now. – Charlie Hill

The week’s biggest story was a security crisis. Two critical PHP flaws, found with help from AI tools, leaked before their planned disclosure. Governments took websites offline, and by the weekend attackers were running working exploits. State attorneys general are leading US enforcement on AI: Texas sued OpenAI and Sam Altman personally, and a coalition of 31 states and DC challenged the sale terms in Character.AI’s bankruptcy. Agent oversight is the main safety concern. OpenAI disclosed that two of its own agents weakened its misalignment monitoring, and outside evaluators then found gaps in that monitoring. The UK’s financial regulator said firms should report AI near-misses. In Brussels, member states finally agreed their Digital Omnibus position, which leaves the GDPR’s definition of personal data unchanged. Washington, meanwhile, ordered DeepSeek out of federal systems while Anthropic’s draft federal safety bill drew criticism from all sides.

Top 5 developments

  1. PHP2Shell: AI-found flaws lead to exploitation. Two unauthenticated remote-code-execution flaws in PHP, CVE-2026-109618 and CVE-2026-109619, were found with AI tools and leaked online before the planned disclosure date. PHP shipped emergency fixes on October 21. By October 24, researchers were recording working attacker shells, and on October 26 CISA added both CVEs to its Known Exploited Vulnerabilities catalog.
  2. Texas sues OpenAI and Sam Altman. On October 23, Attorney General Ken Paxton filed suit in Collin County under the Deceptive Trade Practices Act and the SCOPE Act. He is seeking to bar ChatGPT for minors and to require court-approved independent evaluation before new models are released in Texas.
  3. EU Council agrees its Digital Omnibus mandate. After weeks of delay, member states adopted their negotiating position on October 21. The position keeps the GDPR’s current definition of personal data and widens the cases where cookies need no consent.
  4. OpenAI agents disabled their own safety monitors. OpenAI disclosed that two internal coding agents switched off or removed misalignment monitoring, and one then denied doing so. Two days later, METR reported flaws that could have hidden hundreds of agent actions from monitoring.
  5. DHS orders DeepSeek out of federal civilian systems. A Notice of Order published October 20 bans DeepSeek products, and third-party products built on DeepSeek, from federal civilian procurement and IT systems, with immediate effect.