Hello friends,

On Tuesday we’re gathering in London and I hope to see a few of you there. The topic for this month’s meetup is The Agentic Web and we have two incredible speakers lined up. Tara Ojo Agyemang from Google explaining what we mean when we say “The Agentic Web” and the role WebMCP plays in that. Then we have Nick Ferrell from Focused who will be talking to us about “The Final 10%” explaining what it takes to go from a magical demo to a production ready agentic system. There are just a handful of spots left if you want to come along.

Hannah was in Edinburgh on Monday and Tuesday for Kubernetes community days. It was a fabulous gathering of everyone in the cloud native community. It was lovely to catch up with old colleagues and tech friends, and to be honest it was good to go to an event with a healthy amount of “Non-AI” content. Other technologies are available!

Charles and his wife have just celebrated 27 years of married life together with a delicious beef and root vegetable stew, a glass of red wine, and a trip to the theatre planned to see TS Eliot’s Murder in the Cathedral with David Suchet as the archbishop.

Have a wonderful week!

Hannah and Charles

Early Bird Tickets Don't miss out on the £150 super early bird tickets for our two day extravaganza next February! Buy Ticket

What’s Charles reading this week?

With Hannah focused on one of her favourite topics, the Vulnpocalypse, which perhaps we have to pass through to get to Vulnhallah, I thought I would also return to one of mine: the data centre boom.

To state the obvious, generative AI is driving a huge surge in the number of data centres being built. They need land and they use a lot of energy.

​Demand shifting is one of the standard tactics in the toolkit of anyone interested in green software. The idea is that you run your compute workloads in locations that have an abundance of green energy, provided latency and data protection laws allow. In Europe this concentrates workloads in the Nordic regions, which a quick glance at Electricity Maps will tell you, have lots of carbon free energy from hydro and wind, and also France, which has lots of nuclear energy, another carbon free energy source.

It's sound advice, up to a point, but there are a raft of quite subtle tradeoffs you have to work through. One of those is that grids are finite and may resort to fossil fuel energy sources if you stretch them too far. A second is that concrete has a massive carbon footprint, so if shifting a workload encourages the construction of new data centres that may not be a good thing. And a third, which tends to get overlooked, is land clearance.

This week I read a report from The Guardian’s Miranda Bryant that Google illegally cleared about 330 hectares of forest near Muhos in northern Finland, roughly 250,000 trees, to build a data centre. The topsoil was stripped too, and residents say muddy runoff is reaching a stream that feeds the Oulujoki river. An ecologist from the Finnish Association for Nature Conservation estimates another 150,000 trees were felled at a second site in Otanmäki. This might be a small fraction of Finland’s overall forests, but is still rather grim.

Finland’s licensing authority ordered work stopped at both sites after Google cut the land without completing the required environmental impact assessments. Google’s Finland manager has apologised, saying the company acted on its best understanding of the law at the time, and plans to plant new trees across 130 hectares at the Muhos site. The sites are part of a €13bn project that the Finnish government, led by Prime Minister Petteri Orpo, has actively encouraged.

Finland has 145 datacentres in planning. A petition for stricter regulation and compensation for affected communities has more than 93,000 signatures, and the issue is expected to feature in April’s election. Critics argue the national benefits are minimal because the companies serve international customers and pay little Finnish tax. Locals describe disruption such as wolves entering Otanmäki, though some residents and conservationists accept that the region needs jobs and investment.

In the UK, Dan Milmo reported in the Guardian last month that British AI infrastructure startup Nscale’s data centre project in Loughton, Essex has been told by UK Power Networks that “the grid will not be able to supply sufficient power to the data centre until the early to mid-2030s”.

As a result, and first reported by James Titcomb in The Telegraph last weekend, Loughton’s anchor customer Microsoft has now withdrawn from the project. This is a bit awkward for Nscale, which is pursuing an IPO. Bloomberg reported on Monday that the company is experiencing investor pushback over its proposed valuation of $30 billion. An Nscale spokesperson told The Register “We remain committed to both the Loughton project and the UK and we are exploring alternative power sources for the site, in addition to other expansion sites in the UK. Our relationship with Microsoft remains strong and long-term, and this unfortunate London-wide grid issue has no impact on our other contracts.”

The news is also quite awkward for UK ministers, since Microsoft’s backing for the project formed part of £22bn in UK investments promised by Microsoft last year during Donald Trump’s visit. And, of course, the data centre push and using ‘alternative sources of energy’ makes attempts to reduce our greenhouse gas emissions much harder. I note that in its original launch announcement Nscale claimed Loughton would “be powered by clean energy” although it provided no further details as to how. Against this sort of background, on Wednesday, for the first time, the United Nations Environmental Programme (UNEP) acknowledged reality and conceded that the goal of keeping warming below 1.5° was no longer viable.

Alongside this conflict between climate change and the AI boom another issue that the Government needs to wrestle with is the impact AI may have on employment. Barclays Bank has been on a three year cost cutting program, and is “cutting its staff by around 5,000 as it introduces more artificial intelligence (AI) into its work processes,” the BBC’s Lucy Hooker reports. This amounts to around 5% of Barclays' global workforce. Around 60% of the job cuts will fall within its support functions, including among developers, with a significant proportion of the job cuts expected to fall in India. In a rather unfortunate turn of phrase, Barclays Group chief executive CS Venkatakrishnan describes AI as “the icing on the cake”, though presumably not for the people who are getting laid off. The news comes as UK Prime Minister Andy Burnham is seeking to recruit a number of advisers to plug gaps in No 10, including an expert on how AI will affect society.

Finally from me, I very much enjoyed this article from Aurich Lawson, the Creative Director for Ars Technica, about Apple’s new brand identity for Apple Music.

What's Hannah reading this week?

What a week.

On Monday I spoke at Kubernetes Community Days in Edinburgh about how we need to automate the patching of CVEs (Common Vulnerabilities and Exposures) or we are never going to keep up with the volume of patches we need to apply, and we’re not going to be ready for the next zero-day.

After I’d wrapped up my own talk I watched as Iain Smart and Daniel Wilkinson from AmberWolf talk us through how they built a private cluster on cheap(ish) hardware to run open LLMs and leverage them for security testing (hacking their clients to find and fix issues). The talk was about the Kubernetes cluster, and what they learned, but my takeaway was that you can build yourself a private hacking machine for about £20k.

Dear Santa, For Christmas I would like a hacking machine please.

Then on Wednesday the news hit us. Two critical vulnerabilities in PHP, a critical vulnerability in GitLab, a powerful leaked certificate from eMudhra impacting almost every software supply chain and a collection of vulnerabilities in Node.​

“Patch the planet” is what OpenAI are calling it. Patch the planet indeed. The planet is patching and many will continue patching into the weekend and next week.

[For the less technical readers patching is the process of updating your software to fix a problem. Most of the time it’s not urgent. Like your phone updates, you just apply them every now and then. The problems discovered this week were really frickin bad and required urgent fixes.]

This is headline news because of the severity of the vulnerabilities and because PHP runs 70% of the web. If you’ve heard of wordpress, that’s written in PHP. The vulnerabilities could allow a hacker to execute any code they want on any server running PHP, without needing access to that server. It’s called a remote code execution vulnerability or RCE.

I know I’ve talked about “The Vulnpocalypse” a lot in this newsletter, and I’ve warned anyone who would listen about the tsunami of vulnerabilities we need to prepare for, but this isn’t a moment for an “I told you so”. I think this is the wake up call that many teams needed.

This problem doesn’t go away after we make it through the backlog of patches to apply, because the next zero-day is on the horizon. We don’t know when it will hit but we can be sure that it will. We’ll be patching the planet again and again and again until we eventually get good at it.

Can we all point at this problem and agree that it’s real and urgent?

In my corner of the tech community there was a load of drama surrounding the PHP vulnerabilities (otherwise known as PHP2Shell) because one software vendor broke the embargo before the agreed disclosure date. Usually when researchers discover a new vulnerability they follow a responsible disclosure process, coordinating the release of patches with major tech providers and security vendors. They do it quietly and secretly lest a hacker use this information to exploit the vulnerability before a fix is available.

Chainguard broke the embargo, releasing patched versions of PHP before the agreed schedule. Was it a deliberate shove to make other vendors act with more urgency? Or was this an ill conceived PR stunt so they could scream “Chainguard customers got the fix first”?

If it was a PR stunt it has backfired massively. What’s happened in the aftermath is an uproar of “shame on you” posts from all corners of the tech community who believe that breaking the embargo put more people at risk of exploitation. The timelines around disclosure were already challenging and Chainguard’s actions left everyone else scrambling.

CEO of Chainguard Dan Lorenc took accountability for the decision and defended his actions on LinkedIn:

The response from Nils Aderman board member of the PHP foundation paints a different picture:

The attempts at exploitation before the official disclosure is corroborated by Matthew Prince the CEO of Cloudflare who have been tracking any traffic that looks like an attempt to exploit the PHP2Shell vulnerabilities. In his post on X he shares that exploit attempts were picking up pace ahead of the disclosure. He also shared the incredible numbers of attempted attacks happening since.

Most of these attempts will be AI Agents probing and experimenting and trying to find a pathway in.
​
Terrifying isn’t it?

Updates

Early Bird Tickets Our next 2 day conference is set for 25-26 February 2027. Grab your early bird ticket for £150. Get Your Ticket

October Meetup Our October Meetup is scheduled for Tuesday 27th. We'll be talking about The Agentic Web - WTF is that?! Register

Between Jobs? Interested in a more human approach to career change and AI? Join the Surviving The Gap community for practical workshops, useful resources and early access to Career Core. Learn More

Follow us on LinkedIn Stay up to date on the latest news from the community! Follow

Follow us on BlueSky Stay up to date on the latest news from the community! Follow

Agent Craft Talks Agent Craft talks are now live! YouTube Channel