4 min read

Happy Thursday!

AI found holes in the software behind most of the web, and the NSA's advice was to unplug. DeepSeek raised so much money it had to move its own goalposts twice. And Walmart will now let a robot do your weekly shop, with a spending limit you set first, so it can't come home with a kayak.

Security firm Wiz Research disclosed critical flaws in PHP on Wednesday. PHP is the language behind WordPress, Drupal and Wikipedia's MediaWiki, and Wiz says it powers 70% of the world's websites. Every version back to PHP 5.4 is hit by at least one of the bugs, and severity reaches 9.2 out of 10.

Wiz chained the bugs into one script that took over WordPress, Drupal and Joomla sites without a login. It could also read passwords, tokens and API keys from server memory. Wiz says it used its own agent, Gemini 4 Argon and GPT-5.6 Sol. OpenAI says its partner Calif found one of the flaws with GPT-5.6 Sol. Wiz adds that the code had been vulnerable for more than a decade, and AI let it build working exploits in hours.

PHP released fixes the same day in versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Version 8.1 and older get no patch because they are past end of life. The NSA told organisations to update or take their systems offline, The Hill reports.

These bugs sat in PHP for more than a decade. AI turned them into working exploits in hours. Wiz says PHP runs 70% of websites, and the project won't patch version 8.1 or older. Plenty of small sites still run those, and I'd bet many never update. The NSA's advice is to take unpatched servers offline. Good luck selling that to a bakery's WordPress page.

Lucas

Chinese AI lab DeepSeek has raised about 100 billion yuan, roughly $15 billion, Bloomberg reports, citing people familiar with the matter. It is one of the biggest funding rounds in China's history.

The Hangzhou company raised its target at least twice along the way, from 50 billion yuan to 80 billion and then to the final figure. Battery maker CATL and WeChat owner Tencent were among the largest investors. DeepSeek is also preparing for an IPO, according to Bloomberg.

The money narrows the gap with OpenAI and Anthropic, though each of them has raised more than $100 billion. DeepSeek knocked about $1 trillion off global markets in 2025 by matching Silicon Valley models at a fraction of the cost. The round lands days after Washington ordered DeepSeek removed from federal civilian systems.

DeepSeek went looking for 50 billion yuan and came back with about 100 billion. Demand pushed the target up twice. That's a nice problem to have. It's still small money next to OpenAI and Anthropic, which have each raised more than $100 billion. I think the gap matters less than it looks. DeepSeek knocked $1 trillion off markets in 2025 by doing more with less. Now it has more. Washington banned it from federal systems this week, and China's biggest companies answered with cheques. I'd expect the next model soon.

Tom

Walmart is opening its store to AI shopping agents. Its new Agent Gateway is an MCP server that lets approved agents search Walmart and Sam's Club and buy things for you. It starts as a beta for companies and developers.

Agent Profiles arrive in the next month. Each agent gets its own profile, so its orders show up apart from yours. You can approve every purchase or set a spending limit, and Walmart gives $50 as one example. Agents never see your card details, and Walmart's returns process applies even when an agent goes off script. Amazon has gone the other way and started blocking AI agents from buying, TechCrunch reports.

My favourite detail is that Walmart's returns policy covers agents that don't act as intended. Someone in legal has clearly pictured a cart full of hummus. Approval for every order is the default, and Walmart's example cap is $50. Amazon is blocking agents instead. I think Walmart has the better bet. Amazon wants you shopping inside its own app. Walmart will sell to anyone who shows up, robots included.

Lucas