The week's most relevant AI and tech news, picked from the perspective of a small or mid-sized Estonian company. Short version: what happened and what to do about it.
PHP shipped a critical fix for two remote code execution flaws, and attacks started before the official announcement
The CVE identifiers leaked during coordinated disclosure, giving attackers a multi-day head start on defenders. Why it matters: a large share of Estonian company websites, online shops and booking systems run on PHP — this patch belongs in today's calendar, not the next maintenance window. simonwillison.net
Google's updated privacy terms say Gmail content may feed advertising targeting
Switching on the personal AI features hands Google more signal for ad personalisation. Why it matters: if your business correspondence lives in Google accounts, review which AI features are enabled for staff and whether that fits your data protection documentation. arstechnica.com
Moonshot released Kimi K3.1 Pro at a noticeably lower price than top-tier rivals
It costs $2 per million input tokens and $10 per million output, with full weights promised in early November. Why it matters: for high-volume text work a comparable cheaper model can halve your AI bill — worth running your own use case through two models side by side. simonwillison.net
OpenAI's newest models are arriving on Google Cloud in the coming weeks
The GPT 6.1 family becomes available inside Google's cloud and development environment. Why it matters: if your data and development already sit in Google's cloud, you avoid a separate vendor contract and an extra data flow — simpler procurement, less integration work. arstechnica.com
Anthropic handed the Agent Skills standard to a Linux Foundation body
The MCP protocol went the same route earlier, pushing agent standards toward vendor neutrality. Why it matters: you can write your internal procedures and process descriptions once and reuse them across tools from different vendors, reducing lock-in. simonwillison.net
AI's hidden cost line is storage, not only compute
Every prompt, image and log leaves data behind, and it accumulates into a recurring bill. Why it matters: build retention and deletion rules into the AI project budget from day one, or the monthly invoice will creep up unnoticed. technologyreview.com
The competitive edge now comes from the system around the model, not the model choice
Data, access, monitoring and governance decide whether AI actually works in production. Why it matters: a smaller company gets more out of automating one real workflow and cleaning up its data than from swapping models every month. technologyreview.com