CISA gives federal agencies three days to patch an actively-exploited critical flaw in Ray, the AI framework behind Amazon, Apple and OpenAI's ML workloads
CISA added CVE-2025-62593, a CVSS 9.4 code-injection flaw in the open-source Ray distributed computing framework, to its Known Exploited Vulnerabilities catalog on 17 August, with a remediation deadline of 20 August. Attackers can trigger remote code execution just by getting a victim running Ray to visit a malicious page in Firefox or Safari, using a DNS-rebinding trick that defeats Ray's browser-detection check. Ray 2.52.0 fixes the flaw; CISA confirmed active exploitation before setting the three-day deadline.
Why it matters: Ray sits underneath a huge share of production ML infrastructure, so a flaw this severe and this easy to trigger turns any exposed Ray cluster into a one-click compromise.
Marvell hands Google an option to buy a $12.2B stake, tying its stock price directly to Google's custom AI silicon spend
Marvell issued Google a warrant on 18 August to purchase roughly 59 million shares at $206.58 each, worth about $12.2 billion, under a custom-silicon agreement signed 29 July covering Google's TPU ecosystem, inference accelerators, memory controllers and networking chips. Most of the warrant vests not on a calendar but in 240 tranches, one for every $500 million in custom-chip revenue Marvell books from Google. Marvell shares jumped over 11% on the news while competitor Broadcom fell more than 3%.
Why it matters: structuring the payout around revenue tranches instead of time locks Marvell's upside directly to how much custom silicon Google actually buys, a financing structure built for a market both sides expect to keep growing.
Nvidia in talks to fund Mercor at a $20B valuation, doubling the AI data-labeling startup's price in nine months
Existing investor General Catalyst is discussing leading a new round for Mercor at $20 billion, double its $10 billion valuation from last October, with Nvidia in talks to participate. Nvidia already pays Mercor millions per quarter for the specialized human-expert data used to train its open-source Nemotron models, and Mercor's other clients include OpenAI, Google DeepMind and Anthropic. Mercor's annualized gross revenue hit $2 billion in June, doubling since earlier in the year.
Why it matters: the AI labs are now investing directly in the human-data suppliers they depend on, turning a services vendor into a strategic asset worth defending with capital.
OpenAI's CFO tells staff the company will go public "in 2027, or sooner," pointing to a 35% jump in quarterly revenue
Sarah Friar told employees at an 19 August all-hands that OpenAI's revenue run rate is up 35% quarter-to-date, enterprise revenue is up 50%, and its coding tools have hit 20 million weekly active users, roughly two months after OpenAI confidentially filed its S-1 with the SEC. She framed the IPO as "not a finish line, it is a milestone, another fundraise," citing the $122 billion raised in March as giving the company flexibility on timing.
Why it matters: a sitting CFO naming a specific IPO year to the whole staff, backed by growth numbers, is a much firmer signal than the speculation that's circulated all year.
Grok 4.6 goes generally available on Amazon Bedrock, xAI's first flagship model to ship on AWS's managed model marketplace
Amazon added xAI's Grok 4.6 to Bedrock on 18 August, giving AWS customers direct access to the model's 500,000-token context window and four configurable reasoning levels through the same managed API they use for other Bedrock models. The listing targets long-running agents and coding-heavy workloads rather than chat.
Why it matters: this is a distribution milestone, not the model launch itself (Grok 4.6 shipped 9 August). xAI reaching AWS's enterprise customer base through Bedrock, rather than requiring a direct API relationship, is the same path Anthropic and Meta have used to scale enterprise adoption without their own sales force.
AI Impact Hub