PHP-ocalypse: How two critical web bugs almost broke the internet

What is truly amazing here is that these bugs were present and undiscovered for years! What else is lurking in the trillions of lines of code around the world?

Next question, did somebody exploit these bugs over the years?

"On Wednesday, a decades-old open-source web technology called PHP almost broke the internet, thanks to two vulnerabilities that had sat dormant for years until researchers recently figured out a way to exploit them. ..."

PHP-ocalypse: How two critical web bugs almost broke the internet | TechCrunch

Bank of America deploys 4,000 staff and contractors to fix software bugs uncovered by AI

Wow! What! That is massive! This is just one of the large banks!

"Bank of America hired 1,000 outside contractors on top of 3,000 in-house staff to patch software flaws exposed by Anthropic’s Mythos AI model, CEO Brian Moynihan said Wednesday."

Friday, October 16, 2026 - Join The Flyover

Bank of America hired 1,000 contractors to patch software flaws exposed by Anthropic’s Mythos

Claude Mythos discovers bugs and vulnerabilities so fast and in large numbers that patching them is not keeping up?

Amazing stuff! What a conundrum!

"Mythos discovers bugs and vulnerabilities faster than patches
 
Anthropic and its approximately 50 Project Glasswing partners used Claude Mythos Preview to discover over 10,000 high- or critical-severity vulnerabilities across critical software systems in the first month after Glasswing’s April 2026 launch — including both partner codebases and over 1,000 open-source projects scanned by Anthropic itself.

The real problem has become obvious: nobody can fix them fast enough. Cloudflare alone surfaced 2,000 bugs—400 critical—with fewer false positives than human testers would generate.

Mozilla patched 271 vulnerabilities in Firefox 150, more than ten times the count from previous Claude versions.

Yet of 530 critical bugs disclosed across the program, only 75 have been patched so far, with high-severity fixes averaging two weeks to roll out.

Anthropic scanned over 1,000 open-source projects and confirmed that 90.6 percent of flagged issues were valid after manual review.

The asymmetry matters: attackers with access to similar models could soon exploit this window between discovery and remediation, while maintainers remain swamped by the sheer volume of findings."

"Last month, we launched Project Glasswing, our collaborative effort to secure the world’s most critical software before increasingly capable AI models can be turned against it.

Since then, we and our approximately 50 partners have used Claude Mythos Preview to find more than ten thousand high- or critical-severity vulnerabilities across the most systemically important software in the world. ..."

Data Points

Project Glasswing: An initial update

Our dashboard of open-source vulnerabilities, showing vulnerabilities of all severities (rather than only those estimated high- or critical-severity by Mythos Preview).

The third major Linux kernel flaw in two weeks has been found - thanks to AI

Good news! I also noticed more than usual software update notifications lately with Fedora Linux on my laptop.

AI may not only find security vulnerabilities or software flaws much faster, but also may provide usable information how to fix them without breaking the operation system or causing a bug.

"... According to Linus's law, "Given enough eyeballs, all bugs are shallow," is fundamental to open source. ...

thanks to AI bug-finding tools, such as Claude Mythos and OpenAI Daybreak, behind most of those eyeballs are AI engines, and they're proving to be much faster at finding security problems than human ones. ..."

The third major Linux kernel flaw in two weeks has been found - thanks to AI | ZDNET "AI is exposing Linux security holes faster than developers can patch them. Fragnesia is the latest. Here's what we know about it."

Wikipedia blacklists Archive.today after alleged DDoS attack

Recommendable! An interesting article!

"Wikipedia editors have decided to remove all links to Archive.today, a web archiving service that they said has been linked to more than 695,000 times across the online encyclopedia.

Archive.today — which also operates under several other domain names, including archive.is and archive.ph — is perhaps most widely used to access content that’s otherwise inaccessible behind paywalls. That also makes it useful as a source for Wikipedia citations. ...

“Wikipedia should not direct its readers towards a website that hijacks users’ computers to run a DDoS attack.” Plus, “evidence has been presented that archive.today’s operators have altered the content of archived pages, rendering it unreliable.” ..."

Wikipedia blacklists Archive.today after alleged DDoS attack | TechCrunch

Notepad++ says Chinese government hackers hijacked its software updates for months

Nasty stuff! What about e.g. Microsoft Visual Studio Code or GNOME's default editor GEdit?

Whether it is spying on hotel rooms or software manipulation!

The Chinese Communist Party is a menace!

"The developer of the popular open source text editor Notepad++ has confirmed that hackers hijacked the software to deliver malicious updates to users over the course of several months in 2025. ..."

"... According to the analysis provided by the security experts, the attack involved infrastructure-level compromise that allowed malicious actors to intercept and redirect update traffic destined for notepad-plus-plus.org. The exact technical mechanism remains under investigation, though the compromise occurred at the hosting provider level rather than through vulnerabilities in Notepad++ code itself. Traffic from certain targeted users was selectively redirected to attacker-controlled malicious update manifests.

The incident began in June 2025. Multiple independent security researchers have assessed that the threat actor is likely a Chinese state-sponsored group, which would explain the highly selective targeting observed during the campaign. ..."

Notepad++ says Chinese government hackers hijacked its software updates for months | TechCrunch

Notepad++ Hijacked by State-Sponsored Hackers

AI’s Hacking Skills Are Approaching an ‘Inflection Point’

Bad news! The race of finding and fixing software vulnerabilities in the age of AI!

"Researchers and startups warn that recent AI advances have made models significantly better at finding and exploiting complex software vulnerabilities, raising the risk that attackers could use them to discover zero-days faster than defenders."

AI’s Hacking Skills Are Approaching an ‘Inflection Point’ | WIRED (no public access) "AI models are getting so good at finding vulnerabilities that some experts say the tech industry might need to rethink how software is built."

Credits: Last Week in AI

How-to-safely-secure-the-software-defined electric vehicle

Recommendable! A brief overview! What a challenge!

How-to-safely-secure-the-software-defined-ev "As electric vehicles (EVs) become software-defined and cloud-connected, they introduce powerful new capabilities and a far broader attack surface. Over-the-air (OTA) updates, vehicle-to-everything (V2X) communication, and intelligent charging networks all rely on digital trust."

With software now driving vehicle innovation, securing code, data, and connectivity is mission-critical.

Viral call-recording app Neon goes dark after exposing users' phone numbers, call recordings, and transcripts

What was that all about? Who records phone calls with/without permission?

"A viral app called Neon, which offers to record your phone calls and pay you for the audio so it can sell that data to AI companies, has rapidly risen to the ranks of the top-five free iPhone apps since its launch last week.

The app already has thousands of users and was downloaded 75,000 times yesterday alone, according to app intelligence provider Appfigures. Neon pitches itself as a way for users to make money by providing call recordings that help train, improve, and test AI models. ..."

"Viral call-recording app Neon goes dark after exposing users' phone numbers, call recordings, and transcripts: Call recording app Neon was one of the top-ranked iPhone apps, but was pulled offline after a security bug allowed any logged-in user to access the call recordings and transcripts of any other user."

Techcrunch newsletter

Viral call-recording app Neon goes dark after exposing users' phone numbers, call recordings, and transcripts | TechCrunch

OpenAI’s o3 model helps discover a zero-day vulnerability in Linux kernel

Good news! The race between good guys and bad guys to discover critical vulnerabilities in operating systems etc. with ML & AI is on!

"A security researcher used OpenAI’s o3 model to discover CVE-2025-37899, a dangerous vulnerability in the Linux kernel’s ksmbd server. The researcher provided o3 with approximately 12,000 lines of code from the SMB protocol implementation, using only the standard API without additional frameworks or tools. The vulnerability occurs when multiple connections share session objects, allowing one thread to free memory while another thread still accesses it, potentially enabling arbitrary code execution in kernel context. This marks the first publicly documented case of an LLM finding this type of complex vulnerability, showing that LLMs (while still finding many false positives) can meaningfully assist expert vulnerability researchers. ..."

Google’s Veo 3 video generation model now available in more countries

The Apple macOS security landscape: Moving to become an enterprise and individual user risk

It appears for a long time Apple devices were not targeted as much as Windows devices, but this may change.

It also means that other Unix based operating systems (like Linux and its many derivatives) might by more at risk. I am, e.g. using Fedora Linux.

"Apple’s devices aren’t immune to hacking, but for years, they seemed to be. While other vendors like Microsoft faced the brunt of complex exploits targeting the enterprise market, macOS and iOS didn’t face the same level of pressure as a consumer-focused vendor. 

Yet, this appears to be changing. During the height of the COVID-19 pandemic, Atlas VPN reported that Apple’s product vulnerabilities increased by 467% in the second half of 2021 to 380 exploits. ..."

The Apple security landscape: Moving into the world of enterprise risk | VentureBeat

The unrelenting threat of ransomware and cyber attacks is pushing cybersecurity workers to quit

Is this hype or a serious concern? Probably, a bit of both! Staffing shortages may play a role and so forth.

"Security researchers have warned of "increasing and unsustainable stress levels" in the cybersecurity workforce resulting from persistent ransomware threats and looming, large-scale attacks, which are pushing security professionals towards abandoning the industry altogether.

A report by cybersecurity company Deep Instinct found that 46% of senior and executive-level cybersecurity professionals have considered quitting the industry due to stress. ..."

The unrelenting threat of ransomware is pushing cybersecurity workers to quit | ZDNet Cybersecurity professionals face immense pressure to keep businesses secure, and this stress is leading many to consider leaving the industry altogether.

Google's Allstar aims to fix vulnerabilities in open source projects

Given that I am almost exclusively relying on free, open source software for my daily work etc., I welcome this initiative!

Finally, let the hackers from Russia, China, North Korea, Iran etc. gnash their teeth! High time these many, dangerous open source software vulnerabilities are taken more seriously! 

How important is this news? "Security gaps increasingly plague large open source projects. The number of open source software vulnerabilities more than doubled in 2019 compared with 2018, according to RiskSense. The implications are far-reaching, considering that an estimated 91% of commercial applications contain outdated or abandoned open source components. ..." (VentureBeat Daily RoundUP newsletter 8/11/2021)

"GitHub [owned by Microsoft] and Google today announced the launch of Allstar, an app that provides automated continuous enforcement of security best practices for GitHub projects. Allstar, which was created by Google and the wider Open Source Security Foundation (OpenSSF), can check for security policy adherence, set enforcement actions, and enact those enforcements when triggered by a setting or file change in a repository. ..."

OpenSFF's Allstar aims to fix vulnerabilities in open source projects | VentureBeat

Amazon Web Services Announces AWS BugBust

Good news! Software bugs are everywhere. It has been a plague for decades!

There can never be enough bug busters or bug busting activity given all the vulnerabilities in critical software applications that are discovered daily! Yes, it will also help to prevent cyber attacks!

"... Today, we are excited to announce AWS BugBust, the world’s first global competition for Java and Python developers to collectively fix 1 million bugs. Eliminate software errors and save millions of dollars using Amazon CodeGuru, and win prizes and glory in the first annual AWS BugBust Challenge. Let the bug busting begin! ..."

AWS Announces AWS BugBust