October 22, 2026

Presented By

Buongiorno. We regret to inform you that mozzarella lovers in Italy are not currently having a ball. Protests over high fuel costs by the nation’s truckers have halted buffalo mozzarella production in the country’s southern region, with road blockades preventing milk from reaching dairies. However, the government is poised to approve new transportation and agriculture aid today, which should…get the ball rolling again.

—Matty Merritt, Molly Liebergall, Dave Lozo, Holly Van Leuven, Abby Rubenstein

In today’s newsletter, we’ll get into:

The bug putting most websites at risk
Why Elon Musk wants to combine SpaceX and Tesla
The frustrations of some devoted Brewers fans

Markets

Nasdaq

26,702.86

+1.05%

S&P

7,757.17

+0.58%

Dow

52,856.09

+0.69%

10-Year

5.146%

+3.0 bps

Bitcoin

$84,585.12

+2.23%

Netflix

$65.04

-5.31%

Data is provided by

*Stock data as of market close, cryptocurrency data as of 5:30pm ET. Here's what these numbers mean.

Markets: Like a Cybertruck owner, stocks were all in on Elon Musk yesterday, rising as SpaceX’s impressive earnings (and possible future merger with Tesla, which we’ll get into below) bolstered the AI trade. One company that didn’t join the party: Netflix, which fell after its own earnings missed estimates.

UPDATE NEEDED

About 70% of the internet is in danger

Illustration showing a hacker peeking through a hole in a bunch of abstract code.

Niv Bavarsky

Your IT manager doesn’t have time to recover your email password this week, since over half of the internet needs to be fixed. Yesterday, developers released vital patches for PHP, a programming language that powers roughly 70% of the world’s websites, warning that if those patches aren’t manually deployed ASAP, hackers could cause serious damage.

What happened (for those of us with a BA)? Multiple researchers using AI independently discovered the bug over the summer, and they formed a secret, informal group to try and patch it. They announced the patch on Monday and released it yesterday at 10am ET. The overhaul of PHP was a huge undertaking, with developers writing over 10,000 lines of code to fix the bug. But that’s just the beginning, because now hackers can try to reverse engineer the patch and target other vulnerable parts of the system:

Experts said hackers could use the vulnerability to alter websites, run their own code on servers, and steal data.
Developers ranked the severity of the threat a 9.2 out of 10.

AI is solving the problems it created

Researchers discovered and helped patch the bug with AI’s help so that hackers using supercharged AI models won’t be able to exploit it. The bug found in PHP was actually first flagged years ago, but it was considered low priority, as it was deemed too complicated for hackers to manually access. Now, with AI, they could untangle the system in hours or even seconds.

Ami Luttwak, co-founder of Google’s Wiz cybersecurity team, which helped identify the PHP bug, said this was “the most severe AI vulnerability that was ever found.”

Who should be worried? Basically any WordPress site is at risk. Some providers urged users to take down their sites if they weren’t able to immediately make updates. Finland and the Netherlands took some government sites offline to prevent attacks. Some Wikipedia pages, 4Chan, and BBC sites that host episodes of Doctor Who went dark this week, but the sites’ owners haven’t confirmed whether or not it was to protect the sites. Cybersecurity experts are waiting to see if hackers manage to disrupt any major sites over the next few days.—MM

Sponsored By Skybound

Your favorite superhero’s favorite superhero

Every superhero wants to be #1. That title belongs to Invincible, and the numbers don’t lie. It’s sold 7m comics, been the #1 show on Prime Video for four seasons straight, earned a 99%+ rating on Rotten Tomatoes across all seasons, and generated $450m+ in revenue in its first two seasons.

For a limited time only, you can invest in the studio that created it: Skybound Entertainment.

In a $1t market that’s running out of original franchises to scale, IP is gold. Companies are getting snatched up for billions of dollars, but only if they own their rights like Skybound. Now Amazon just green-lit their new series, Stillwater, priming Skybound for their next win.

There are only hours left to invest and get a 5% bonus.

World

Tour de headlines

Josh Edelson/Getty Images

🤖 Meta creates new class of stock to finance AI, keep Zuck around. Facebook’s parent company kicked off Big Tech’s earnings season after the closing bell yesterday, revealing it beat Wall Street’s revenue expectations and that its AI investments throttled available cash flow. To finance its continued AI spending, Meta announced a 2-for-1 stock split, which will give each owner of a Meta Class A share a non-voting Class C share. The move will ensure that CEO Mark Zuckerberg’s voting power remains unchanged, as the earnings report also revealed that a special committee established by the board determined that it’s in the best interest of the company for Zuck to remain at the helm for the long term.—HVL

⚖️ Meta ordered to pay $25 billion over data privacy violations. Meta probably expected all the headlines to be about its earnings report, but hours before its release, it got slapped with an attention-grabbing legal penalty. A New Mexico Judge ordered the company to pay $25 billion in a data privacy case stemming from a scandal involving the political consulting firm Cambridge Analytica obtaining Facebook users’ data in 2018. Last month, a jury found that Meta had violated the state’s consumer protection laws 43 million times—with each violation carrying a $5,000 penalty, so the $25 billion the judge imposed was actually a reduction. The social media giant previously resolved other cases related to the scandal, and has recently faced additional legal challenges over the safety of children on its platforms.—AR

🧹 Your Airbnb host can’t make you do chores anymore. The company has heard all those social media complaints about stays ending with chore lists so long they make guests feel like Cinderella before the ball, so Airbnb is updating its policy. As of Nov. 20, hosts won’t be allowed to require guests to do laundry, dishes, or “things a cleaner should handle,” though “reasonable” requests will still be permitted, Airbnb said yesterday. House rules will now be included on the listing page, and Airbnb said it will flag requests that run afoul of the new policy, giving hosts the option to remove them or appeal.—AR

TESLAX

Here’s why Musk would merge Tesla and SpaceX

Row of Tesla Cybertrucks in front of SpaceX facility with mural of rocketships

Ronaldo Schemidt/Getty Images

Oops, Elon might do it again. Months after folding his AI startup, xAI, into SpaceX, Elon Musk said the boards of his rocket company and Tesla have formed committees to explore a merger of their own, sending shares of SpaceX up nearly 8% yesterday.

This would likely be the biggest corporate merger ever, forming a company worth ~$3.5 trillion. Musk said he supported the tie-up, but noted that he wouldn’t be involved in discussions (though his friends and longtime investors sit on both companies’ boards).

Musk has several reasons to want to create the Russian nesting doll of tech:

For starters, he could get $110 billion richer, per Bloomberg.
He could also get 56% voting power over the combined entity, Barclays analysts estimated, accomplishing his longtime goal of gaining more control over Tesla.
Between its data centers, AI models, robots, rockets, and satellites, the conglomerate would enjoy “an end-to-end advantage that nobody else could replicate quickly,” a commercial space analyst told the New York Times.
This could also be another instance of Musk ~~saving~~ fusing an underperforming company with a higher achiever. Tesla’s core automotive business was down, as was its energy revenue, per yesterday’s better-than-expected earnings report, while SpaceX’s business is booming.

Looking ahead…Musk’s best chance of regulatory approval would likely be under the Trump administration. The odds of the merger happening before 2028 were 84% on Kalshi yesterday.—ML

Sponsored By micro1

Earn $100k–$2m+ from company data. micro1 pays active or closed US businesses with 50+ employees to license their operational workflow data—such as emails, Slack conversations, and internal documents—for AI training, helping AI learn real business tasks. Get your data estimate, or refer a company to earn up to $50,000 per successful referral.

TICKET DISASTER

Brewers fans are mad over a botched ticket promo

Milwaukee Brewers fans waving and shouting in stands at baseball game

Rob Tringali/Getty Images

Game 1 of the World Series takes place in Milwaukee tomorrow, but some Brewers fans are mad about it. In 2015, the team sold 1,000 “Timeless Tickets” for $1,000 apiece with a promise that they could be redeemed for the best seats to any one future game. But when fans went to use them for the World Series, that turned out to be untrue.

Instead, Timeless Ticket holders were given nosebleed or standing room only tickets.
Brewers representatives said that seats near the field weren’t available after numerous presales.

On Tuesday, the team’s president of business operations, Rick Schlesinger, who created the promo in 2015, admitted to the mistake, saying, “We did not live up to the spirit of the program.”

In an attempt to make things right, the Brewers are allowing anyone who used their golden ticket for this year’s World Series to use it again in the future. But they may have to wait awhile for a moment like this—it’s only the second time the Brewers have made it to the Fall Classic in 57 years of existence.

Brew solidarity: While the baseball Brew Crew let fans down, anyone who wants to see our Brew Crew play softball next summer can show up and sit anywhere they want.—DL

Reader Poll

Which team are you rooting for in the World Series?

The Brewers—I’m a fan.
The Rays—they’re my team.
I was a Brewers fan, but this ticketing controversy has me questioning.
I wasn’t a fan before, but I’ll join this newsletter in supporting Brew Crews of any kind.
I haven’t picked a side yet.
I’ll decide during the games based on who’s winning.

Molly explains the internet

Would you buy a ticket just to see these guys?

Group of young men wearing Halloween fact paint and costumes

Hersheypark

The online world can be a beautiful yet confusing series of tubes. On Thursdays, the Brew’s Molly Liebergall untangles them for you.

A squadron of skull-faced performers is helping drive business for Hersheypark in Pennsylvania. They’re called “haunt sliders”—knee-pad-equipped scare actors who speed towards park-goers on all fours. The ones who work during Hersheypark’s Dark Nights event in September and October, known as the “Decayed Brigade,” have gained a cult following online for their scary good looks.

They seem to be the K-pop group of amusement park mascots, in that there are eight of them, they do great floor work, and lustful fans travel from all over to see them. According to Business Insider:

The most viewed TikToks on Hersheypark’s account are of its haunt sliders.
Some people in the comment sections (which are full of suggestive quips) say they discovered Hersheypark through the Decayed Brigade’s videos. “We have people who have bought our season passes because of it,” a park spokesperson said.
“This year especially, it feels like every other person’s coming up saying they drove eight-plus hours to come see us or they just came for us,” a haunt slider named Fryboy said.

Though it’s only gone viral in recent years, haunt sliding was invented decades ago at Knott’s Scary Farm in Southern California, the original haunted amusement park event.—ML

Three Headlines and a Lie

Three of these headlines are real and one is faker than your uncle adhering to a semi-formal dress code. Can you spot the odd one out?

It’s sliced cheese on bread. And it’s rocking Copenhagen’s world
Man sues company for unlawful termination after he refused to answer his phone
Black bear breaks into California library to raid snacks and eat jar of honey
Bus driver ‘farted so badly’ it led to sacking after colleagues ‘needed a shower’

Share the Brew

Share the Brew, watch your referral count climb, and unlock brag-worthy swag.

Your friends get smarter. You get rewarded. Win-win.

Your referral count: 0

Click to Share

Or copy & paste your referral link to others:
morningbrew.com/r/?kid=71df84e8

Answer

We made up the one about the unlawful termination lawsuit.

Word of the Day

Today’s Word of the Day is: squadron, meaning “a group of people.” Thanks to Lydia from Austin, TX, for assembling the suggestion. Submit another Word of the Day here.

✢ A Note From Skybound

This is a paid advertisement for Skybound’s Regulation CF offering. Please read the offering circular at https://invest.skyboundentertainment.com.

Written by Abigail Rubenstein, Matty Merritt, Molly Liebergall, Dave Lozo, and Holly Van Leuven

Was this email forwarded to you? Sign up here.

Get smarter in just 5 minutes

Tech & AI News: Tech Brew
Markets News: Brew Markets
Real Estate News: The Playbook
Money & Career: Bossy

Take The Brew to work

Interested in podcasts?

Check out ours here.

ADVERTISE//CAREERS//SHOP//FAQ

Update your email preferences or unsubscribe here.
View our privacy policy here.

Copyright © 2026 Morning Brew Inc. All rights reserved.
22 W 19th St, 4th Floor, New York, NY 10011

☕️ Very vulnerable