OpenAI reportedly eyes $1.25T valuation
PLUS: Governments sound alarm over PHP flaws AI helped find
Good morning. OpenAI is reportedly working on a $30B raise at a $1.25T valuation. That would make it the most valuable private company ever and set a higher bar for its IPO and Anthropic's.
In today's issue:
📰 Today's Headlines
OPENAI
OpenAI reportedly lines up record private round before IPO
The Yuzu Squeeze: OpenAI is reportedly working on raising up to $30 billion at a $1.25 trillion pre-money valuation, in a round led by Coatue and UAE investors, according to CNBC.
The details:
- Bloomberg reported a month ago that OpenAI was seeking $30 billion at a $1.4 trillion valuation, and both outlets say terms are still being negotiated.
- CNBC reports the UAE funding could be paired with a deal giving OpenAI more computing capacity from the UAE. OpenAI declined to comment.
- OpenAI's last raise in March valued it at $852 billion post-money, and it filed confidential IPO paperwork in June.
- Anthropic raised $65 billion at a $965 billion valuation in May and is reportedly seeking $1.5 to $2 trillion for its public debut.
Why it matters: A valuation above $1 trillion would make OpenAI the most valuable private company ever and raise the bar for its own IPO. It also sets a benchmark for Anthropic, whose public S-1 filing is rumoured to be imminent and whose listing many see as closer.
CYBERSECURITY
🛡️ Governments sound alarm over PHP flaws AI helped find
The Yuzu Squeeze: Two critical PHP vulnerabilities, dubbed "PHP2Shell," could let hackers remotely run malicious code on servers. They prompted warnings from the NSA, FBI and authorities worldwide as Google, OpenAI and Amazon helped respond.
The details:
- The NSA warned the flaws could give attackers direct access to server file systems and databases. It advised taking systems offline if updates can't be applied immediately.
- Amazon said its MadPot system detected exploit attempts before public disclosure, though it remains unclear how attackers learned about the flaws early.
- Google said its Wiz unit used AI models to find and investigate the flaws, while Gemini helped test potential attacks and verify patches.
- OpenAI said researchers using its models helped uncover the bugs, and it spent two months leading a coalition to coordinate fixes before disclosure.
Why it matters: The PHP team has released fixes and Cloudflare has added firewall protections, but attackers were probing before disclosure. OpenAI called the flaws among the most significant in recent memory. The episode shows AI cutting both ways: it helped find these bugs, and similar capabilities could be used by criminals.
Why it matters for Asia: Singapore's cybersecurity authorities issued an alert alongside the UK, Australia, Canada and the EU, urging operators of PHP-based systems to patch.
🌏 Asia Headlines
DEEPSEEK
DeepSeek nears $15B round, double its original target
The Yuzu Squeeze: DeepSeek is wrapping up a funding round that has raised about 100 billion yuan ($14.98 billion), according to four people with knowledge of the matter. CATL and Tencent are among the biggest investors.
The details:
- Midea, Meituan, Geely and GigaDevice joined as new investors, alongside Boyu Capital, CPE, Legend Capital and existing shareholder IDG Capital. More than 15 investors took part.
- The round values DeepSeek at 500 billion yuan before new money, Reuters has reported, and is set to close in the coming days.
- The total is double DeepSeek's original 50 billion yuan target, though one source said financial details and the investor lineup could still change.
- Reuters reported in September that DeepSeek had hired CITIC Securities to prepare for a potential STAR Market IPO.
Why it matters: Many of the investors are backed by the state or big corporations, a sign of China's push to get ahead of the US in AI. The round also moves DeepSeek closer to a listing, a month after it released DeepSeek-V4.1-Flash.
CHINESE HACKERS
Microsoft says AI agents powered China-aligned ConnectWise hack
The Yuzu Squeeze: China state-aligned hackers broke into ConnectWise's cloud backup service, stole credentials and used AI agents to hack into around 2,250 organisations, according to Microsoft security researchers.
The details:
- The stolen application credentials let hackers log in to customers' Microsoft-hosted environments as authorised users and access emails and other files.
- Microsoft said the attackers made almost 3,000 attempted sign-ins per minute, a speed that gives defenders "little time to detect and respond."
- The speed came from ARTEX, an open-source AI framework for stress-testing cyber defences. It was also used in a recent compromise of South Korea's financial systems.
- ConnectWise paused access to its cloud backup system and is investigating. On Thursday it said it was working on restoring the service.
Why it matters: Breaching one IT provider gave the attackers a path into thousands of its customers. Open-source AI agents made the attack faster than defenders can easily react to. The same tool hit South Korean financial systems, many of which had weak security and lacked multi-factor authentication.
🔥 Hot on Social
⚡ Quick Link
1Password launched 1Password for Agents, which lets AI agents like Anthropic's Claude Duet and OpenAI's Dots log in to accounts after user approval without seeing passwords. link
That's it for today. See you tomorrow!
