PHP has shipped emergency updates fixing two critical flaws, found by AI, that let an unauthenticated attacker run code on almost any server using the language. The fixes, in versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35, ended two frantic days in which websites around the internet were taken offline while waiting for a patch.
Announced at GTC Berlin, the expanded collaboration aims to help companies secure autonomous agents, govern access to AI models and run workloads on Nvidia's upcoming Vera Rubin infrastructure. The updates center on Red Hat AI Factory with Nvidia and add runtime controls for agents.
Cyberattacks, data leaks and dependence on US giants have made protecting sensitive data a strategic issue for Europe. Clubic looks at 'air-gapped' clouds that run without any internet connection, and at how Clarence Cloud uses the approach to run AI in an isolated environment.
Anthropic pointed Claude at 25 widely used open-source projects, asking it to find code that attackers can reach when they should not be able to rather than isolated bugs. Claude flagged 493 such issues, one of which had been in the software for 21 years.
The startup Recursive is betting on using AI to build AI. It argues that the benefits of recursive self-improvement outweigh the risks, and Wired describes its latest model as alarmingly capable.
In July, Docker, Snyk and Keycard published Agent Baseline, an open, vendor-neutral reference architecture setting security outcomes for running AI agents in companies. Docker now builds on it to address the security of the systems that produce software.