Today’s top line: A critical PHP vulnerability is being widely exploited and a ConnectWise breach used AI agents to compromise thousands – highlighting AI’s growing role in both cyber offence and defence. Also: major moves in medical AI, satellite embeddings and enterprise models.
Mass PHP2Shell flaws discovered and broadly exploited
What happened: Researchers and cloud providers disclosed two critical PHP vulnerabilities that were being exploited in the wild. Amazon said it saw an exploit attempt four days before public disclosure; the NSA and UK authorities warned organisations to patch or take affected systems offline, and vendors released emergency patches.
Why it matters: PHP powers a large share of the web (WordPress and many sites), so these flaws risk widespread server takeover and disruption. The episode also underlines how frontier AI both accelerates vulnerability discovery and can enable rapid offensive tooling.
Source: Ars Technica
Chinese hackers used AI agents to breach ConnectWise and spy on 2,250 organisations
What happened: Attackers who Microsoft links to China-aligned actors breached ConnectWise’s cloud backup service, stole application credentials and used them to access customer Microsoft-hosted environments. Microsoft said the attackers used AI agents and a framework called ARTEX to attempt almost 3,000 sign-ins per minute, enabling access to around 2,250 organisations.
Why it matters: This is a large supply-chain style compromise that shows how automation and AI agents can scale intrusions, giving defenders little time to detect and respond. Organisations using ConnectWise or similar management tools must assume credential misuse and urgently follow vendor guidance.
Source: TechCrunch
Microsoft’s DxO system beats generalist physicians on complex cases
What happened: Microsoft published a Science study showing MAI-DxO, an orchestration of AI agents, correctly diagnosed complex cases 83% of the time versus 36% for primary care doctors and general internists working individually. Tests used complex cases from the New England Journal of Medicine and multiple underlying models; with GPT-5 DxO cut an estimated cost per case by about $3,000 from roughly $8,400 while improving accuracy slightly, and with GPT-5.5 DxO raised accuracy from 72% to nearly 87% on complex cases.
Why it matters: The results suggest multi-agent orchestration can boost diagnostic performance, especially on complex cases, but gains depend on the base model and clinical context. Healthcare providers, regulators and vendors should watch how such systems perform in real clinical teams and how cost, safety and responsibility are governed.
Source: TechCrunch
OpenAI’s Decisions API positions models for fast, low-cost choices
What happened: OpenAI promoted its Decisions API as a product for fast, focused, low-cost decisioning workloads. The announcement frames the API as a way to build more responsive applications that need quick, option-based choices rather than full freeform language generation.
Why it matters: Decision-focused models can reduce latency and cost for many enterprise workflows where structured choices and confidence scores matter. Businesses building high-throughput automation should evaluate these specialised APIs alongside general LLMs.
Source: OpenAI
OlmoEarth v1.3 releases global 10m satellite embeddings
What happened: AllenAI and Hugging Face released OlmoEarth v1.3, a satellite embedding model that produces one 128-dimensional vector per 10-metre pixel for annual radar and multispectral time series. Precomputed global embeddings are available without sign-in; the 128-dimension vectors led on 20 of 27 evaluation tasks versus competing models and the first 64 dimensions work as a smaller option.
Why it matters: Ready-made, planet-scale embeddings cut the compute and data burden for mapping tasks such as crop classification, change detection and land-cover mapping, letting organisations build lightweight classifiers on top of shared features rather than retrain large models from scratch.
Source: Hugging Face / AllenAI
Kumo Relational delivers predictions from relational databases with no training
What happened: NVIDIA and Hugging Face published Kumo Relational, a pre-trained foundation model for relational (multi-table) databases that makes predictions from a single forward pass. Out of the box it reportedly outperforms traditional pipelines such as XGBoost on benchmarks: nearly 4 AUROC points on RelBench V1 and 7 MRR points on SAP SALT without fine-tuning.
Why it matters: Structured-data foundation models can replace weeks of feature engineering and per-task training, turning predictions into queries. That could speed productisation of predictive workflows across finance, sales, and operations.
Source: Hugging Face / NVIDIA
Uber rolls out ChatGPT Work to 30,000 employees
What happened: Uber is deploying ChatGPT Work to more than 30,000 employees to assist with research, data analysis, presentation creation and complex workflows.
Why it matters: Large-scale internal adoption by an operations-heavy company like Uber signals continued enterprise uptake of workplace LLMs and raises practical questions about governance, data protection and productivity impact.
Source: OpenAI
Quick hits
- Canva launches its own image model, Canva Craft – Canva released Canva Craft, a two-stage image generator trained on design templates that produces up to 2K images and can convert outputs into layered designs; API and third-party integrations planned. (TechCrunch)
- 1Password lets AI agents sign in without seeing passwords – 1Password for Agents uses a digital key flow so selected AI assistants can sign in on a user’s behalf while keeping credentials hidden. (TechCrunch)
- OpenAI models will run on Google Cloud and Antigravity – Google Cloud will add the latest OpenAI models to its Model Garden and Antigravity client, making them available to enterprise customers via Google infrastructure. (Ars Technica)
- SpecEvo paper shows multi-LLM workflow cut API costs up to 80% – The SpecEvo speculative-evolution framework coordinates lightweight and frontier models to match or beat frontier baselines while reducing API costs and improving evaluation efficiency across discovery tasks. (arXiv)