This edition leans heavily on security: two broad vulnerabilities need action this week. The rest covers model choice, agent tooling standards and the real cost of running AI.
PHP shipped fixes for two remote code execution flaws, and attacks started before the announcement
The CVE identifiers leaked from the coordinated disclosure process days early, so attackers were scanning servers before defenders knew anything. Why it matters: a large share of Estonian SME websites, web shops and internal tools run on WordPress or other PHP stacks — this upgrade belongs today, not in the next maintenance window. simonwillison.net
Private keys for eight eMudhra intermediate certificates were compromised
They chain to roots trusted by Chrome, Windows, Apple and Mozilla, and updates have already landed in Linux distributions and Python tooling. Why it matters: if your servers, CI pipelines or integrations carry stale trust lists, someone could sit in the middle of your encrypted traffic — have your IT partner refresh certificate bundles. simonwillison.net
OpenAI's newest models are arriving on Google Cloud in the coming weeks
The same model family becomes available through more than one cloud provider rather than a single vendor channel. Why it matters: less lock-in and more leverage when negotiating pricing or discussing where your data physically sits. arstechnica.com
Anthropic handed the Agent Skills standard to a Linux Foundation body
The Model Context Protocol went the same route earlier, pushing agent tooling toward vendor neutrality. Why it matters: in-house agent skills and integrations are more likely to keep working if you later switch model providers. simonwillison.net
Meta removed the word "train" from its commercial terms but still won't commit to robots.txt
The wording changed after public pushback; the underlying scraping practice largely did not. Why it matters: if your content, product descriptions or blog are a competitive asset, review what your site permits bots to do and what your client contracts say. arstechnica.com
The real AI bill includes storage, not just GPUs
Every prompt, image and log leaves data behind that someone keeps paying to store, and the volume quietly compounds. Why it matters: when you model the business case for an AI project, budget storage and data management too, or year two will spoil the payback math. technologyreview.com
A model without business context produces technically correct but practically wrong advice
Without knowledge of your processes, constraints and dependencies, recommendations stay abstract. Why it matters: for a smaller company the money is better spent cleaning up your own data and workflows than trialling yet another model. technologyreview.com