Mailr — Friday, 23 October 2026
 |
| FRI, 23 OCT, 2026 |
ISSUE # 88 |
|
|
Two kinds of darkness.
Eternal is building Dark, a chatbot it says even it can’t read. And PHP2Shell, critical flaws present in PHP since version 5.4, has just come into the light. Patch now. Plus: trademark filers may need to declare AI, and NITI wants data centres audited. |
| |
|
📋 In today's Mailr:
|
|
|
|
|
Your product here, in front of 200+ Indian tech builders, Mon · Wed · Fri.
Tap the logo to book a slot.
|
|
|
🌍 Global AI |
|
Critical PHP flaws let attackers seize web servers |
|
Image source: Google Nano Banana 2 |
| • |
Two PHP flaws (CVSS 9.2 each) let attackers run code on web servers without logging in. PHP versions 5.4 through 8 are affected. Patches are in versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Amazon saw exploitation attempts before the official patch was released. |
| • |
OpenAI says GPT-5.6 Sol found one flaw; Wiz found both independently. Details leaked a day before coordinated disclosure. Sites running Magento and other PHP apps are confirmed vulnerable. Take unpatched systems offline if you cannot patch immediately. |
|
Bottom Line: AI is now finding critical vulnerabilities faster than disclosure timelines can contain them, compressing the window between discovery and active exploitation. If your product runs on PHP, assume the patch window is hours, not weeks. |
|
|
|
🇮🇳 India |
|
Zomato parent Eternal teases private AI chatbot Dark |
|
Image source: Google Nano Banana 2 |
| • |
Eternal's Dark.ai runs fine-tuned open-weight models (publicly available base models adapted for a specific use) on its own servers with end-to-end encryption. Deepinder Goyal says even Eternal cannot read user conversations, targeting founders, journalists and governments wary of mainstream assistants. |
| • |
Encrypted memory carries context across sessions. Goyal calls its answers the best he has seen, but no independent security audit, pricing or launch date is public. A global launch is targeted for 2026. |
|
Bottom Line: Consumer companies are starting to compete on privacy architecture, not just AI capability. Founders building AI tools for enterprises or governments should note that verifiable encryption claims, not just policy promises, may become a real purchasing criterion. |
|
|
|
Trademark filings may require AI-use declarations |
|
Image source: Google Nano Banana 2 |
| • |
India's Trade Marks Registry draft guidelines require every filing to declare whether AI was used. Non-disclosure is treated as misrepresentation. AI cannot be used to write affidavits or generate evidence such as labels, invoices or translations. |
| • |
Penalties range from striking a citation to referral to the Bar Council. Gaps remain: no AI field exists on current forms, and it is unclear whether grammar or translation tools count. Rules are not yet in force. |
|
Bottom Line: Mandatory AI-use disclosure in official filings is spreading across Indian regulators, with trademark filings among the first in scope. Founders and IP agents using AI to draft submissions or generate brand evidence should audit their workflows now, before the final rules are notified. |
|
|
|
NITI Aayog wants central audits of data centres |
|
Image source: Google Nano Banana 2 |
| • |
NITI Aayog's Frontier Tech Hub proposes MeitY-led audits of data centre operators, requiring power, water and carbon efficiency metrics at design stage and post-commissioning. New features include red zones barring water-stressed sites and community impact assessments before construction. |
| • |
It is a guidance document, not regulation, and relies on secondary data. MeitY currently holds no official figures on national data centre capacity. A separate national policy is in progress with no public draft yet. |
|
Bottom Line: State-level data centre policy is shifting from investment-announcement competition toward audited efficiency standards. Operators planning new facilities should factor in mandatory reporting of power, water and carbon metrics (PUE, WUE, CUE) and potential red-zone site exclusions from the start. |
|
|
|
⚡ Mailr Signal |
|
|
The PHP disclosure is the clearest public evidence yet that AI models are now capable of finding critical, unauthenticated remote-code-execution flaws in foundational infrastructure. OpenAI's coordination role here signals that AI labs may become routine partners in security disclosure pipelines, changing how the industry manages vulnerability timelines.
Our take, not a news summary.
|
|
|
🛠️ Tool of the Day |
|
|
Bud Ecosystem
Unified platform for training, inference, routing, and AI agents
| 🇮🇳 |
India-based GenAI research lab partnered with NxtGen for sovereign cloud AI solutions. |
| ✅ |
Named to Microsoft's AI cohort and proven in production at global enterprises. |
| 💡 |
Best for: Enterprises adopting generative AI affordably and at scale with minimal infrastructure costs. |
View tool →
|
|
|
📱 Social Scan |
|
 Tired of hunting for his AC remote, a developer reverse-engineered the appliance and vibe-coded a Mac menu bar app to control it. In 2026, apparently it's easier to build software than look between the sofa cushions.
View post →
|
|
|
🧠 Knowledge Bank |
|
|
RLHF: Learning From Human Ratings
| • |
RLHF teaches an AI what a good answer looks like. People compare two responses to the same prompt and pick the better one. Those choices train a scoring model, which then rewards the AI for answers people prefer. It works for tasks that are hard to define but easy to judge: no one can write rules for a helpful reply, but anyone can spot one. ChatGPT was tuned this way. |
| • |
Global models learn their sense of a good answer from whoever rated them, and unrepresentative raters bias the result. That can miss how Indian users write, especially in Hindi, Tamil or Hinglish. Builders can close the gap without a big budget: log thumbs-up and thumbs-down from real users, then tune with DPO or KTO, simpler methods that skip the full RLHF pipeline and need only preference labels. |
|
|
|
|
আকৌ লগ পাম
Thanks for reading. If something felt off or overhyped, reply and call it out — your feedback makes every edition sharper.
The next edition is already taking shape. Don't miss it.
Were you forwarded this? Join free at mailr.tech
|
|
|
You're receiving this because you subscribed to Mailr.
© 2026 Mailr
|
|
|
