Unfixed Newsletter — October 15–25, 2026
Editors’ Note: An AI identified vulnerability in a piece of fundamental website software absolutely rocked the internet in this news cycle. We still run into people who think the AI disruption will not impact their corner of work. Well, if your work involves accessing the internet in literally any form AI has now impacted it. Whether your LMS slowed down, or you could not log into a database for research, this story impacted all of us in higher ed. Outside the academy this highlights the vulnerability of everything from banking to healthcare. There were some additional interesting stories we will unpack, but the sheer scale of this security vulnerability makes it the clear leader in this cycle.
The Stories
1) AI-assisted security research exposes critical vulnerabilities across the web
On October 21, Hypertext Processor (PHP) released emergency patches for two critical security vulnerabilities that could allow attackers to take control of affected web servers without authentication. PHP powers roughly 70% of websites, including sites built with WordPress and Drupal. Researchers at Wiz, OpenAI, and Calif used advanced AI systems to identify and demonstrate exploitable weaknesses in code dating back more than a decade. The PHP Foundation acknowledged that an earlier investigation had identified the underlying problem in 2024, but development of a fix had stalled. Amazon subsequently reported exploitation attempts beginning October 17.
Why this matters: Where to even start? Cybersecurity, information access, news, this vulnerability impacted nearly the whole web. This will not be the last time. Instead, this just makes real something we have speculated about for a while. AI makes flaws vulnerable and visible in so many parts of higher education and life outside the ivory tower. If you are involved in security at an institution the time to staff-up was yesterday. We also think this makes a case for secure data backups on local hardware, especially of grading information and cutting edge research. We will probably still be processing the impacts of this into the next cycle.
https://www.wiz.io/blog/php2shell-php-rce
2) Florida’s statewide AI rules for public colleges take effect
On October 20, new AI regulations took effect across Florida’s 28 public colleges. Adopted by the State Board of Education in September, the rules require colleges to establish policies covering approved AI tools, academic integrity, student privacy, intellectual property, and AI literacy. Students cannot use AI on graded assignments or assessments unless explicitly permitted by their instructors. Colleges must also notify parents when enrolled minors will directly use approved AI instructional tools. The regulations apply to Florida College System institutions, not the state's public universities.
Why this matters: This is the largest scale of higher ed policy implementation we have seen to date. Even though it is only the college and not the University system, we think this warrants close attention. We keep saying this needs to be an era of experimentation and this takes that to a higher level than we have seen before. The part about this we think should be modeled at scale immediately is the requirement institutions develop local policies. One of the truisms of the AI age is that if you don’t have a policy–you actually do and that policy is “anything goes.” There still is not an enforcement mechanism for a ban, but this push at least surfaces the conversation.
Links: https://flrules.org/gateway/ruleno.asp?id=6A-14.0719&Section=0
3) AI tutoring company sparks faculty backlash after emailing students about its tools
On October 19, the CEO of AI tutoring company CircleIn emailed 224 students at SUNY Geneseo encouraging them to use its tutoring platform, despite faculty policies restricting AI use in some courses. Professors objected, and Provost Mary Toale instructed the company to send a clarification affirming instructors’ authority over AI use in their courses. CircleIn CEO Gerald Meggett Jr. acknowledged that the email was a mistake. The company’s partnership with Geneseo is part of a SUNY pilot program that allows faculty to opt out each semester.
Why this matters: Professors have speculated about how we are perceived by tech companies and AI companies in particular. Are we collaborators? Unwitting rubes? Previously Nik wrote an excellent piece on this relationship. In this instance at least, the company in question has a very dim view of instructional faculty. It was good to see University leadership rallying to the side of faculty, but the real takeaway here appears to be CircleIn saying the quiet part out loud. If you are at an institution with a contractual relationship with an AI lab it is worth reviewing their ability to directly contact students and having a preliminary conversation to make sure you have a mutual understanding before something like this happens.
4) Nationwide AI walkout draws students and activists demanding a freeze
On October 20, demonstrators participated in coordinated walkouts and protests across approximately 50 U.S. cities and college campuses, demanding a freeze on advanced AI development until stronger public oversight is established. Organized by the advocacy group Irreplaceable, the demonstrations raised concerns about employment, environmental costs, surveillance, and corporate influence over AI development. Protests included gatherings outside OpenAI offices and events involving students and educators. Attendance varied considerably; approximately two dozen people participated in the San Francisco demonstration covered by KQED.
Why this matters: This was a really interesting protest. On our own campus there was more of an emphasis on the CSU relationship with OpenAI while on other campuses the focus was broader. We have covered public opinion about AI quite a bit, but this is different. Student activism does sometimes result in broader political change. This is different from a public opinion poll because demonstrating takes effort. If nothing else, this seems to signal there is a group of students on campuses that are moving beyond responding to surveys–they are activated. Of course the demands may be unrealistic, especially given the prominence of Chinese AI labs that are not particularly concerned with the politics of American college students, but this is more about a changing political and activist landscape than concrete change at this point.
https://irreplaceable.org/freeze-ai
5) UK universities push back against AI vendors over pricing and institutional control
On October 27, UK education technology organization Jisc released a statement backed by Universities UK, GuildHE, and the Association of Colleges calling for greater transparency and accountability from AI suppliers. The document asks vendors to disclose pricing and usage costs, provide tools to monitor spending, prevent institutions from paying twice for the same underlying AI services, and allow colleges and universities to switch models or providers without losing functionality. The statement establishes expectations for future procurement negotiations, rather than binding requirements.
Why this matters: This is the highest profile effort we have seen where universities are trying to dictate terms to the labs. We think this is significant because it might be a model for other systems. It will be interesting to see how AI suppliers respond to this set of demands. These also seem like pretty basic principles that should be applied for consumers outside of higher education spaces as well.
Links: https://repository.jisc.ac.uk/files/ai-licensing-statement.pdf
https://wonkhe.com/wonk-corner/jisc-explains-procuring-ai-the-sensible-way
From Our Work
Preparing Rural California Means Investing in People, Not Just Tech
In our latest EdSource piece, we argue that California’s AI workforce strategy needs to include rural communities and invest in universities and community colleges that prepare teachers, healthcare workers, agricultural specialists, and other professionals these communities need.
https://edsource.org/2026/ai-impact-rural-california/768008
Ep. 43: What Can American Universities Learn from Germany? with Tony Waters (October 19)
Sociologist Tony Waters joins Unfixed to compare higher education in Germany and the United States, including faculty responsibilities, student expectations, and how universities in both countries are responding to generative AI.