Two Critical PHP Flaws Could Put Millions of Websites at Risk

Morning, {{first name | folks}}! Critical PHP flaws are triggering emergency security patches, while Anthropic is rolling out an AI agent that works in the background. Microsoft is tackling a key challenge in AI-generated code, NVIDIA is making business predictions easier to deploy, and Google Cloud is adding OpenAI’s models to its platform.

PHP has released emergency security patches for two critical vulnerabilities that could let attackers run malicious code on web servers or access sensitive data. The flaws affect PHP installations dating back to 2004, putting websites and platforms built on widely used software such as WordPress and Magento at risk. Security researchers have already detected early attacks.

AI tools helped uncover the flaws, but their discovery also highlights how quickly vulnerabilities can surface. With PHP powering much of the web, security teams are urging organizations to patch affected systems before attackers exploit them.

Anthropic has introduced Claude Duet, a proactive agent that monitors connected apps and handles tasks without waiting for prompts. It can draft emails, schedule meetings, build dashboards and prepare financial forecasts across more than 6,000 integrations.

The bigger change is that Claude can keep work moving between conversations, spotting what needs attention before someone asks. Users still approve sensitive actions, and the research preview is rolling out by waitlist to Claude Pro and Max subscribers in the US.

Microsoft Research has developed a Proof-Driven Development (PDD) Kit that checks whether AI-generated code does what a developer intended. It turns instructions into formal specifications, then uses mathematical verification to check the code. The kit supports Rust through Verus and integrates with GitHub Next’s Chopin.

As coding agents take on more of the work, catching mistakes after the code is written may not be enough. PDD Kit aims to check correctness upfront, giving developers a way to verify what an agent produces rather than relying on tests alone. The approach could be particularly valuable for software where a hidden bug carries serious consequences.

NVIDIA has introduced Kumo Relational, an AI model that predicts customer churn, fraud, and product demand directly from connected databases, without task-specific training or manual feature engineering. It outperformed leading supervised models across 41 tasks and 15 databases.

The model could make predictive AI much easier to deploy, cutting the work usually needed to build custom models. It could also help AI agents anticipate what might happen next, from customers leaving to products selling out.

OpenAI is bringing its AI models and Codex coding tools to Google Cloud, giving businesses another way to access them through Google’s cloud platform. Customers can run OpenAI’s tools alongside their existing cloud infrastructure instead of managing a separate setup.

The deal gives businesses more flexibility in choosing AI tools, while putting OpenAI models alongside Google’s own offerings. It’s another sign that cloud platforms are becoming a key battleground for AI companies competing to reach enterprise customers.