Effective Immediately, all organizations using PHP for their systems are advised to be prepared for an update addressing two critical vulnerabilities. PHP is widely used for web applications. These vulnerabilities often provide a direct path to the server's file system or database. If an immediate update is not feasible, it is recommend that organizations take the system offline until it can be fully mitigated. NSA will follow up shortly with more specific guidance.

Tesla really did it. This isn't AI.

Marco Rubio: “We preoccupy ourselves more with the comfort of the worst than the potential of the best. We hold the most exceptional things among us hostage to the average.”

Chief Design Officer @jgebbia officially unveils America.gov, the new online home for the United States of America

A few thoughts on the current state of venture capital. When the Music Is Playing In July 2007, a few weeks before the credit markets seized up, Chuck Prince, then the CEO of Citigroup, gave an interview to the Financial Times. The line everyone remembers is this one: "As long as the music is playing, you've got to get up and dance." He was mocked for it for years afterward, and he lost his job a few months later. But I have come to think he was saying something honest. He wasn't claiming the music would play forever. He was admitting that he couldn't sit down while it was still going, and neither could anyone else in his seat. I've been thinking about that quote a lot lately, because right now is the most disorienting period in venture capital I can remember, and I have been doing this for a while. Here is what makes it disorienting. It's not that things are bad. Some things are spectacular. We have companies in our portfolio growing faster than anything I have seen in my career, and I don't say that lightly. At the same time, we have companies with no revenue, no product, and a founding team you could fit in a conference room raising billions of dollars at valuations of $10 to $50 billion. Both of these things are true at once, and if you try to reason about them with the same framework you will drive yourself crazy. Two ideas have helped me make sense of it. Neither is mine. The first is reflexivity, which George Soros has been writing about since the 1980s. In most of life, perception follows reality: the weather is what it is, and your opinion of it changes nothing. In markets, it runs the other way too. Prices change what participants believe, and what participants believe changes the prices. The feedback loop can run for a long time, and while it's running it looks exactly like progress. Here is how reflexivity is playing out in AI. Full disclosure: Menlo is an investor in Anthropic, so read the following with that in mind. People watched a frontier lab go from a $4 billion valuation to $18 billion, then $60 billion, then $180 billion, then $380 billion, and now something close to a trillion. They drew the obvious conclusion: that is what a neo lab looks like. So the next neo lab gets priced off that path, not off anything it has built. Then it gets marked up in a subsequent round, and the markup itself becomes the proof. Look at Thinking Machines. Look at Reflection. At that point valuation has stopped being an output of the metrics and has become the metric. Nobody is discounting cash flows. They are discounting the last round. Soros is very clear about one thing, and it's the part people skip: you cannot know when or how a reflexive process ends. You only know that it does. Every one of them has. The second idea is Chuck Prince's, and it explains why smart people keep dancing even when they can see the loop for what it is. As far as I can tell, there are two groups on the dance floor. The first group got in early. Firms like ours were in some of these AI companies before the numbers got silly, and the paper gains are enormous. When you are sitting on gains like that, you start to feel like you're playing with house money. I have been around long enough to know that house money is the most dangerous kind, because you don't respect it the way you respect money you had to earn. The second group missed the early rounds and knows it. Their LPs know it too. So they are trying to make up for lost time by writing very large checks very late, which is the one strategy almost guaranteed to turn a missed opportunity into a real loss. House money on one side, FOMO on the other, and reflexivity feeding both. That's the whole story. Everyone has a reason to keep dancing, and the reasons are different, which is why nobody can talk anyone else off the floor. So what do you do? The instinct in our business is to answer with company identification: just pick the right neo lab and you'll be fine. I think that's the trap. When price has become the signal, being right about the company is not enough, because you can be right about the company and still be wrong about the price by a factor of ten. The public-market investors I admire figured this out a long time ago. They spend as much time on how much to own as on what to own. The winners in venture over the next decade will be the firms that treat portfolio composition and position sizing as seriously as they treat sourcing. How much of the fund is in companies whose valuation rests on the last round rather than on revenue? What happens to the portfolio if the reflexive loop breaks next year instead of in five? Those are not exciting questions. They are the ones that will matter. The music will stop. It always does. Dance if you must, but know where the chairs are.