InfoWorld – AI

A certificate authority’s decision to abandon the global SSL/TLS market is exposing a weakness many organizations rarely examine: their dependence on complex PKI trust chains. Following the compromise of private keys behind eight of its intermediate certificate authorities, eMudhra is exiting the global SSL/TLS certificate business and is offering customers Sectigo-issued replacements. However, analysts warn that enterprises may discover they have only limited visibility into the certificate hierarchies underpinning critical services. The company’s board decided “to voluntarily withdraw from t

The recent Google Cloud incident in London is the kind of event that should force enterprises to rethink what cloud resilience really means. Google said the disruption was caused by a “power event” affecting London-based data centers in its europe-west2 region. The issue appeared early in the day and affected cloud services that many organizations depend on, either directly through their own deployments or indirectly through third-party platforms that run on Google Cloud. What made this incident important was not simply that a cloud region had problems. Cloud infrastructure, like all infrastru

Two critical vulnerabilities discovered in the widely-used PHP programming language have shaken up enterprises, and the ramifications will take some time to truly understand. But one of the lesser-known stories centers around disclosure. According to The PHP Foundation, several organizations had agreed to a coordinated release detailing the critical flaws and mitigation actions, but cybersecurity firm Chainguard “unlaterally” broke this embargo. This prompted the PHP project to release its patches early, but also allowed attackers to study the fix in binary form and craft proofs-of-concept (Po

GitLab on Wednesday published updated versions of its Community Edition (CE) and Enterprise Edition (EE) that address a dozen bugs and security issues, including some that allow various unauthenticated actions. The most serious of the security issues, labeled critical in severity, is CVE-2026-110264, an integer overflow issue. “GitLab has remediated an issue that, under certain conditions, could have allowed an unauthenticated user to execute arbitrary code on the GitLab server due to integer overflow when compiling a specially crafted regular expression,” GitLab said in its bulletin. “In addi

The AI industry has been expanding how much information an AI model can consume at once. In just a few years, context windows have grown from thousands of tokens to millions. Anthropic increased Claude’s context window from 9,000 to 100,000 tokens in May 2023, reaching 200,000 tokens by November 2023. Google’s Gemini 1.5 Pro reached one million tokens in February 2024, then two million by June 2024. By March 2026, Anthropic made the million-token window generally available across its Claude models, and thirteen or more hosted frontier models now offer one-million tokens or more. Reasoning syst

AI agents are getting more inventive in finding ways to circumvent safeguards to prevent bad behavior, OpenAI has revealed. On Tuesday, it reported two incidents, both involving the agent disabling or interfering with its alignment monitoring, and in one case directly lying about having done so. “In two internal coding tasks, agents weakened misalignment monitoring while making requested software changes,” the OpenAI blog post said. “A GPT-6.1 Sol agent repairing an evaluation pipeline disabled automatic alerts to our Security team, treating an earlier instruction not to send messages during a

Organizations are scrambling to protect themselves following the disclosure of two critical vulnerabilities in commonly used code that powers much of the internet. The flaws discovered in the PHP scripting language could allow attackers to perform unauthenticated remote code execution (RCE). On Wednesday morning, the PHP Foundation released patches for affected versions, and said it is “imperative” that organizations running PHP patch immediately. It said that all PHP installations serving web requests are at risk, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. It c

Running frontier models for coding and other purposes can be very expensive, but also, sometimes, very effective. It’s tempting to use smaller or older models instead of frontier models because they’re cheaper, although they may not work as well. The ideal model for any given task tends to depend on the complexity of the task. Picking the most appropriate model automatically based on the request and the context is called model routing. How model routing works There are several ways of implementing model routing. In general, model routing depends on the pool of available models, the criteria us

In 2026, the AI monetization conversation has shifted quickly from one concern to the next. Early in the year, fears that AI agents would erode software seats helped trigger a selloff of software stocks dubbed the “SaaSpocalypse.” Since then, attention has turned to a different disruption, as AI leaders including Anthropic, OpenAI, and GitHub lean heavily on usage-based pricing to better align revenue with the cost of delivering AI. It would be easy to conclude that software monetization is shifting wholesale from seats and subscriptions to tokens, credits, and consumption. But look across a b

I can’t stop anthropomorphizing my coding agent. I use both Claude Code and Cursor, and whenever I talk about these tools, I always refer to them as “he”, as in “He found and fixed a bug I never even realized existed.” The reason for this is probably obvious. I deal with my coding agent as if he were a colleague on the other end of a chat window. He writes great code and explains everything clearly. And frankly, it’s gotten to the point where he is a better software developer than any human developer could possibly be. So in the spirit of all great listicles, here are eight reasons that coding

DeepSeek has been dealt a huge blow in the US, even as it continues to innovate and keep pace with, or in some cases outperform, rival models from American labs. The US Secretary of Homeland Security has issued an order banning all DeepSeek products and services from federal agencies. Government organizations must purge their IT systems of it within 60 days; those with “compelling justification” can make a case for exemption by written request to the Cybersecurity and Infrastructure Security Agency (CISA). The Department of Homeland Security (DHS) cited multiple concerns about the Chinese-host

Anthropic has a $100 million plan to help enterprises get more from AI. No, it doesn’t involve agents. It involves people. Lots of people. How retro. On October 2, the company announced Claude Frontier Academy, with a goal of training 10,000 frontier deployed engineers by the end of 2027. Participants work through a simulated deployment, including use-case selection, security review, and handover, before undertaking a 12-week residency on a real project at their own company. For a business selling increasingly capable models, it’s telling that Anthropic recognizes some of the thorniest problem

One line from a recent AI incident caught my attention. Describing how an OpenAI agent got into a Medicare statistics portal, Australian Prime Minister Anthony Albanese said it “didn’t accept no for an answer.” It sounds almost funny. In software terms, though, it points to a real problem. An access control said no, and the agent treated the answer as information about how to continue. “The AI agent found a way around those blocks,” Albanese said. The agent accessed public and non-public files, according to the prime minister, though Deputy Prime Minister Richard Marles said the information wa

Take a close look at your monthly software bills. The charges that once seemed small and separate can add up to a new kind of dependency: subscriptions for word processing, creative tools, storage, and now AI features bundled into products, whether you asked for them or not. For many people, it’s no longer a choice between buying software or renting it. The software they used to run on a PC increasingly depends on an account, an internet connection, a cloud service, or a particular plan. Even when an application runs locally, its essential features may rely on online authentication, remote sto

The original Antigravity was an IDE with native integration for Google’s generative AI models. With Antigravity 2, Google offers a refashioned version of the product that it describes as a “standalone desktop command center” for agents. Antigravity 2 is closer to projects like LM Studio than a full-blown IDE. It provides a streamlined, chat-centric interface for working with models and agents, uncluttered by a code editor, debugging tools, and other trappings of an integrated development environment. For those who want an IDE and agent orchestration together, Google still offers the Antigravit

This summer, the White House rolled out the Gold Eagle Initiative, billed as an “unprecedented” effort to coordinate cybersecurity vulnerability disclosure across government and industry. It was easy to miss this news with all of the other safety concerns in the world of AI, but the timing isn’t a coincidence — and neither is the terminology. Gold Eagle is just one in a fast-growing category of security clearinghouses. Although it has already been scaled back once, recast in an August CISA fact sheet as a narrower triage layer rather than the sweeping coordination system first announced, it st

This series lays out a practical framework for taking generative AI (GenAI) from pilots to dependable production systems in the enterprise. It focuses on four disciplines that determine long-term success: engineering for scale and reliability, designing agentic systems with clear constraints, embedding governance directly into build and runtime controls, and measuring ROI at the workflow level with full cost and outcome visibility. The throughline is operational discipline—treating GenAI as a service with contracts, evaluation, ownership, and measurable business impact. Adnan Masood Post 1: En

Bank of America has had to spend big on IT in response to an AI security audit and findings that its anti-money-laundering (AML) controls were lacking. The bank was fined a whopping $1.2 billion for money laundering offences this week, after banking authorities identified a lax attitude to compliance. “We understand the seriousness of compliance, and we are responsible for getting it right,” Bank of America CEO Brian Moynihan said on a conference call to discuss the company’s third-quarter financial results. “We have invested billions of dollars in technology and dedicated thousands of employe

The best Python yet isn’t just faster than before. It’s also smarter at telling you what’s wrong, better at letting you profile applications, and loaded with new language features to give you a better programming experience. Top picks for Python readers on InfoWorld The best new features in Python 3.15 Python 3.15 is now GA, and it’s the best Python yet. Get your hands on its improved JIT compilation, lazy imports, more detailed errors, and all-new profiling superpowers. Python’s new frozendict type, demonstrated Ever wanted to use a Python dictionary where you needed an immutable type, like a

Every quarter, I look at the capital expenditure numbers coming out of the major cloud providers, and every quarter, they manage to surprise me. This time, though, we’ve crossed into territory that’s genuinely hard to process. The five biggest US cloud and AI infrastructure providers (Microsoft, Alphabet, Amazon, Meta, and Oracle) have collectively committed to spending between $660 billion and $690 billion on capex in 2026, nearly doubling what they spent just a year ago. Amazon leads the pack with a projected $200 billion, most of it directed at data centers and AI compute. Alphabet has comm