Anthropic launching the background agent app Claude Duet, Meta ending marketing messages on the WhatsApp Cloud API, and stolen UpdraftCentral keys used to backdoor WordPress sites
Today's 3 verified stories: on October 21, 2026 Anthropic introduced Claude Duet, an agent app that works in the background, as a research preview built for professionals and small business owners. Meta will stop carrying marketing messages on the WhatsApp Cloud API on October 13, 2027, moving marketing templates to the Marketing Messages API. UpdraftCentral keys stolen from TeamUpdraft's customer database were used to install backdoor plugins on WordPress sites connected through UpdraftPlus. The detailed look at each story, its sources and what it means for your business lives on its own page.
Anthropic launches Claude Duet, an agent app that works in the background
On October 21, 2026 Anthropic introduced Claude Duet, a research preview built for professionals and small business owners; TechCrunch covered the app a day later. Each morning Duet gathers the most important items across connected apps into a daily summary, checks those apps every few hours during the day, and sends a message only when something needs attention. Before sending a message, making a payment, signing a document or deleting anything it waits for approval, and trading securities or moving money between accounts is not possible even with approval. Access is by waitlist, for now for Pro and Max subscribers in the US; Team and Enterprise plans are not part of the preview yet.
Meta ends marketing messages on the WhatsApp Cloud API on October 13, 2027
Meta has set October 13, 2027 as the date its WhatsApp Cloud API stops carrying marketing messages; after that, promotional templates can only go through the Marketing Messages API (MM API). Promotions, offers, newsletters and abandoned-cart nudges count as marketing templates and must move, while service, authentication and utility messages stay on Cloud API. Messaging accounts created on or after April 13, 2027 cannot send marketing messages through Cloud API, and accounts created earlier keep that access until October 13, 2027. Meta lists three migration steps and puts the typical integration effort at roughly 2 weeks.
Keys stolen in the TeamUpdraft breach were used to plant backdoors on WordPress sites
TeamUpdraft, the developer of the WordPress backup plugin UpdraftPlus, detected unauthorised access to teamupdraft.com over the weekend of October 17-18, 2026. According to the company's October 19 incident post, the customer database that was reached held names, email addresses, billing addresses, order history, hashed passwords and the connection keys for UpdraftCentral, UpdraftVault and UpdraftClone. Patchstack says the attacker used valid UpdraftCentral keys to install backdoor plugins on connected sites; the campaign ran in an 18-hour window and at least 99 different plugin names were logged. The problem is the keys, not the plugin code. UpdraftPlus 1.26.13 and 2.26.13 revoke the keys but do not remove a backdoor or admin accounts already created.
The agenda moves fast, the system stays calm.
Let us talk about what these shifts mean for your business and work out together which step fits you.