Trust is being rebuilt outside the thing it protects: in the registry, the certificate store and the DPU.

Today's headline

Trust is being rebuilt outside the thing it protects. PHP is about to patch two critical remote code flaws that leaked before their embargo. Eight certificate authority keys turned out to be guessable. And NVIDIA's answer to rogue agents is enforcement that the agent's own host can't touch.

On the clock

Today at fourteen hundred UTC, PHP ships an out-of-cycle security release. Reserve a patch window now.

Tomorrow, Thursday the twenty-second, the Gemini API shuts down the Veo three point one previews and the Omni flash preview. Google says those are the earliest possible dates. The replacement is Gemini Omni one point one flash. MCPCon and AGNTCon North America also start tomorrow and run through Friday.

On Friday the twenty-third, OpenAI retires a long list of older models, including gpt-4 and o1. Google's older Deep Research agent shuts down the same day, and MiniMax says its Flash model goes open weights then.

Meta's new business terms take effect on the thirtieth. OpenAI Evals goes read-only on the thirty-first, and DeepSeek's free search promotion ends the same day.

Do this week: repoint the retiring OpenAI models, move Veo and Omni callers, and export your saved evals.

Security

The lead is PHP. The project will release emergency fixes today for two critical remote code execution flaws. PHP rates both nine point two. Details leaked before the planned embargo, so the release moved up a day. PHP powers a huge share of web applications, so even a short delay in patching matters. Researchers at watchTowr are the source for the CVE numbers and for the claim that very old versions are affected. PHP itself has confirmed neither. Only PHP eight point two through eight point five get fixes. No exploitation has been reported yet. Severity is critical. Read PHP's own advisory for the fixed versions, then patch.

Next, a certificate problem. Eight intermediate keys from the certificate authority eMudhra were so weak that anyone could recover them in a few hundred guesses. One published key was literally the number four. That means an attacker could forge a certificate for any website. eMudhra blames a script error, and says most of these certificates never reached end users. There is no evidence of abuse, and no CVE. Go, the major browsers and Cloudflare now block the keys. The keys were generated in April of last year, so the window was long. Cloudflare also shipped updated WARP and tunnel clients. Upgrade Go, rebuild your services, and update your trust stores, including container base images.

Third, Pillow. A critical heap overflow in its JPEG decoding is reachable through the thumbnail function. The advisory gives no severity score and we don't know if it's exploited. Because there is no CVE shown, scanners may stay quiet. Check the advisory for the fixed release.

And two agent protocol libraries have fresh advisories. In the MCP TypeScript library, a shared transport could hand one client's responses to another client. A single request could also exhaust server memory. The A2A Java library has a fail-open default for task authorization. These are rated high. Upgrade, and stop sharing one MCP server instance across clients.

Do this week: upgrade Go and rebuild. Patch PHP once the fix is out. Audit your MCP servers.

Agents

NVIDIA launched a reference architecture for safe agents, built around a piece called Sentry. Sentry runs on a BlueField-4 data processing unit, outside the host. It sits on the agent's only path to the model, applies access policy, and keeps tamper-evident logs. The idea worth stealing is monitoring that the agent cannot disable. Anthropic, AWS, Microsoft and OpenAI are named as partners. NVIDIA is the only source, so wait for independent testing.

GitHub opened a public preview of a package firewall. It sits between coding agents, build runners and npm. Administrators can set a cooldown, check advisories for malware, and catch attestation downgrades. It's free during the preview and will be metered later. It covers npm only, so installs from other ecosystems still bypass it.

And a vendor study from Hirundo found Qwen3-Coder wrote code nineteen percent more likely to be hackable when told it was for a US defense contractor. Hirundo sells a fix, so treat it as directional. CrowdStrike and Booz Allen reported similar bias earlier. Whatever model writes your code, scan its output in your pipeline.

Do this week: turn on a dependency cooldown in your package manager or in GitHub's firewall.

Models and pricing

DeepSeek open-sourced DeepInfer, the serving engine behind its V4.1 Flash API. It's built on vLLM and released under Apache two point zero. It bundles DeepSeek's own kernels and supports speculative decoding. If you self-host that model, benchmark it against stock vLLM. DeepSeek also released a companion library that reproduces its API's request handling. Huawei chips get equal billing with Nvidia. There are no independent numbers yet.

OpenAI says its newest models are far better at legacy code. On a COBOL migration test, GPT six point one Sol reached eighty-seven percent at low effort, up from about five percent for the previous Sol. On a separate test that asks models to build a database engine in twenty languages, its top model passes about eighty-seven percent of tests. OpenAI built the tests, so these are its own figures.

Cloudflare took up tsrs, a Rust port of the TypeScript compiler. Cloudflare reports it is up to eight times faster and uses seventy percent less memory. That's the company's benchmark. It stresses this is a port, not a fork, and says it is working with the TypeScript team. Their next TypeScript release is already up to two and a half times faster. The draw is coding agents that can type-check their work cheaply.

Quick ones. Mistral launched Voxtral three, a voice agent stack with transcription from about a third of a cent per minute. Google open-sourced TorchTPU, which lets PyTorch apps run on its chips with a configuration change. It follows Amazon's TorchNeuron by a day.

Business and policy

Google Cloud and NVIDIA say Vera Rubin instances reach general availability next month. Google plans up to nine hundred sixty thousand Rubin GPUs across sites. There is no price or exact date yet.

OpenAI acquired Orchestra Bio, which builds agents that track clinical trials. It will fold into OpenAI's life sciences platform. Terms weren't disclosed.

Three federal agencies, NIST, CISA and the NSA, published ten practices for responding to rogue AI agent incidents. They run from preparing to detecting, responding, recovering and reporting. The guidance targets frontier developers, but the least privilege and credential management steps apply to any team running agents. It is voluntary.

Two quick ones. NVIDIA added a reference humanoid and a new robot learning release to its open robotics stack, all company-stated. And Anthropic reports that Claude designed protein binders against scorpion toxins. Of two hundred eleven designs tested in the lab, seventeen bound. Whether they work as an antivenom is untested.

Before you go

The thread today is trust anchors. Certificates, packages and agents all need controls that sit outside what they guard.

Do this week: upgrade Go and rebuild, and update your trust stores. Patch PHP after today's release. Audit MCP servers for shared instances. Turn on a dependency cooldown. And move your Veo and Omni callers before Thursday.