A security researcher has revealed how they were forced to update the time on their car infotainment system using reverse engineering techniques. Of course, invasive tech surgery shouldn’t be needed for this kind of basic routine daylight saving time tweaking task. However, Rasmus Moorats’ 2014 Renault Latitude wouldn’t allow him to adjust the time because the original navigation map SD card was missing.

Moorats had been warned. When he bought the used car, the previous owner noted that the SD card would be required to change the time on the in-car display. “I didn't really find that believable,” recalls the security researcher. They seem to have believed it was a skill issue of the prior owner and, because the maps it contained were chronically out of date, they decided to confidently decide they didn’t need the SD card...

The time to adjust non-connected clocks to daylight saving time inevitably came, and Moorats decided to adjust the in-car time display, which had become an hour out of sync. Two settings menus were available via the in-dash system. One allowed the adjustment of Bluetooth and Phonebook settings – clearly no use here. But the second settings menu wouldn’t produce any submenu. Instead, an error message "No maps detected!" popped up every time it was prodded.

With a certain set of skills under his belt, Moorats decided to “just RE it,” where RE = reverse engineer. He found out that the head unit ran a customized Linux-based TomTom operating system on a Samsung SoC. In brief, he extracted and analyzed the firmware, built a QEMU environment for the device, reversed the scripting engine, and uncovered a number of vulnerabilities affecting the system.

The breakthrough came in a brainwave, which seems to stem from experience with kernel exploit techniques during his day job. “Instead of trying to get the userland to execute our script, why don't I get the kernel to execute our script instead?” pondered Moorats. The approach worked, rewarding Moorats with root-level access to the infotainment system.

The 2014 Renault Latitude owner subsequently discovered that the date & time settings were in /mnt/flash/settings.dat in a custom binary format. Interestingly, the system “doesn't really have a concept of time zones at all,” observed Moorats in the conclusion of his blog post. “It gets the time from GPS and stores the local offset as a number of minutes. Mine was set to 180. I changed it to 120.”

The internet is still reeling from the PHP engine vulnerability and all other security vulnerabilities found over the past few weeks, and we're not done. Today's special is quite spicy: you can get into Alpine, OpenWRT, and other Linux distros without needing a password, thanks to a combined bug with OpenSSH and musl libc. Just randomly type over 256 characters on the password prompt and you'll be let in through the SSHhole.

It works if you set an empty password for system users, which is the default on multiple distros. The bug is present, though not necessarily enabled, across Buildroot, Yocto, and Void Linux. OpenWRT uses Dropbear for authentication by default, but users can install OpenSSH instead.

The largest concern is by far Alpine, though, as it's pretty much the default choice for what could amount to millions of installs across Docker/Kubernetes/Proxmox containers and endless dependencies thereof, servers, cloud VMs, and embedded devices, among many others. Alpine comes with the requisite conditions set and password authentication enabled by default, which is why it needs immediate patching.

Broadly speaking, the vulnerability combination is: OpenSSH, musl, password authentication not explicitly disabled, not using PAM, and the one arbitrary user with a password set, using a SHA-512/256 hash.

Patch your systems immediately, as per the project's advisory note. Meanwhile, the easiest mitigation is explicitly setting "PasswordAuthentication" to "no" in your OpenSSH configuration file and restarting the service.

While in practice the vast majority of Alpine and similar installs aren't reachable from the internet, any attacker inside a network, including but not limited to corporate setups, home labs, cloud networks, and VPNs, can let themselves in. Likewise, all it takes is one valid user account, not too hard to get in a large enough corporate environment, and then an attacker is inside the network. Scanning and testing the vulnerability is also trivial.

OpenSSH has already published a fix and an advisory post, as did musl author Rich Felker. Both parties seem to believe the other is at fault, but looking from the outside, blame is shared.

If you've ever looked in the /etc/passwd or /etc/shadow files, you may have noticed a single asterisk as a placeholder for the password hash for accounts with no password — meaning "no password should work." The SSHhole website has all the details, but the snafu happens both when musl's crypt() function returns "*" as an error condition instead of a null value as per usual conventions, and then OpenSSH uses it to compare to a password hash, when it shouldn't. An overly long input then triggers the chain of mistakes.

European fridges are so hot right now. Right on the heels of repeated cyberattacks on supermarket freezers, a fresh wave of attacks has hit units used by France's blood service (EFS). Thankfully, no biomaterials were lost, as the attack triggered the EFS' alerts, prompting staff to move the affected goods to proper storage.

The French Health Ministry said that the situation is being closely monitored and that no assets were lost. The attack seemed focused on refrigeration units at three sites, with Burgundy-Franche-Comté reportedly among them. The EFS' communiqué says the intrusion was on a service provider, which some outlets are reporting as Coolworld.

Coolworld has posted a notice stating that the incident was due to "remote monitoring software" used in its systems, pinning the cause on "a component from a third-party supplier." There are no technical details available yet, so it's not yet clear if the hackers found internet-reachable equipment, as they did with the supermarket attacks.

It's possible that Coolworld keeps the controllers inside its own network and that malfeasants had to first gain entry to said network. However, it's worth noting that it was the EFS' monitoring and alarm system that noticed something was up — not the vendor's.

We don't know which brand of refrigerator controllers Coolworld uses, but the ongoing attacks seem to be happening on a per-vendor basis. Danfoss is the most-mentioned name — particularly, but not only, in the recent Nov. 1 - 2 attacks. Copeland/Dixell controllers were named in the Oct. 13 - 14 attacks.

A Danfoss datasheet recommends that its controllers are installed with "appropriately configured firewalls and secure LAN," and not "on any public or non secure network." That's not saying much, as punching holes in a firewall is nearly the same as having the unit directly reachable. The firm did issue a recent support bulletin clearly stating that the units should be installed with a VPN, but that document only appeared in October 2026. We couldn't find previous mention of this advice in our searches.

The manuals for the Copeland/Dixell controller units that were hit in earlier attacks advise installers to map ports 80 (web) and 22 (Secure Shell) to the internet so that the units can be reachable from the outside, suggesting a VPN only as an option. The firm has since published a security advisory recommending that the units only be reachable from inside a VPN. This was published Oct. 14, after the first wave of attacks.

Many news outlets claim to have seen materials — namely, in now-deleted Telegram posts — in which Russia-aligned hacking groups Noname057(16) and Z-Pentest are claiming responsibility for the attacks. Z-Pentest reportedly posted 2,500 lines of Danfoss code, but none of these alleged materials have been published. The purported hackers claim the attacks are about highlighting bad cybersecurity practices.

It's tempting to once again bring up AI agents as vehicles of cyber-destruction, but the reality is that, just like what happened with PHP, most of the time all bots are actually doing is revealing shoddy security practices and/or copious amounts of technological debt.

The phrase "when it rains, it pours" applies both to weather and computer security, as proven the week of October 19, 2026, when OpenAI's GPT 5.6-Sol discovered critical vulnerabilities in the open-source programming language PHP. As published in a post-mortem, a small team of maintainers knew of the issue two years ago. Security experts had warned for decades about mounting technical debt, as agentic AI exponentially sped up vulnerability scanning, to the point that the usual 90-day disclosure window for security exploits became pointless. PHP, one of the internet's ubiquitous software packages, was unlucky enough to in the crosshairs of bug-hunting AI agents.

PHP hosts around 70% of websites on the internet, and the vulnerability allows for remote code execution with enough attacker knowledge. That combination is enough to sound alarms, but the situation got worse once the collective internet realized that, at the time, 73% of PHP installations online were running end-of-life versions with no active support — eliciting face-palms from many techies, and an exasperated sigh from anyone familiar with the ecosystem, myself included. So ultimately the problem wasn't really the vulnerability, but the general complacency.

How the attack came to be

The root cause of the vulnerability was an ancient architectural decision in the PHP engine's error handling. When a PHP process runs out of memory, it'll call the longjmp() C function, which means "immediately jump the execution to another place, no questions asked." Using longjmp() without a very good reason is generally unadvisable, though that by itself wasn't the problem.

The real issue is that if that jump happens while building a data structure (like adding an array entry, or initializing an object), that half-baked data remains in the memory heap. When the PHP engine moves execution to its cleanup-end-exit mechanism, that code will execute expecting good, complete data, but instead acts on inconsistent leftover bytes.

With some clever injection of just the right content in a web request, this mechanism can be exploited to run any code with PHP's permissions, as shown by the ongoing PHP2Shell exploit.

Gaining a remote shell does require an attacker to know the exact version and build of PHP used, so it's not as trivial as just pressing the "Hack" button. Yet the wide blast radius, with tens of millions of vulnerable servers, many of them running the same exact version, is enough to give anyone pause. After the vulnerability was made public, many sysadmins disabled version number reporting on their PHP installation, so as not to aid prospective hackers.

The PHP Foundation's post-mortem indicates that the team had known about the issue for two years, but didn't immediately see it as a cause for concern, and went back and forth several times on the best way to fix the problem while maintaining compatibility with third-party extensions.

The team admitted it had made management mistakes, but it's a small outfit with one full-time employee and 14 part-time contractors, tasked with maintaining one of the most widespread pieces of software on the internet. This is a common pattern: open-source software that's of critical importance to modern computing, yet undermanned, underfunded, or both.

The exploit is only half of the problem

The standard patch process is reasonably trivial, needing only a point update and perhaps requiring a restart of some services. The currently maintained branches of PHP are 8.1 through the current 8.5. Sysadmins rarely install PHP directly, though, relying on their Linux distribution of choice or community repositories for updated packages.

Those 73% of sites still stuck with PHP 7 are now stuck between a rock and a hard place. When PHP moved from 7.4 to 8.0 in late 2020, there were a number of changes to the language, most of them minor, but still requiring revision work. Many folks likely expected their distro to keep backporting fixes, especially for LTS (Long-Term Support) variants still in their support period, with PHP 7.4 in tow. That excuse is arguably always a little thin, as even before the AI age there were already automated tools to upgrade existing PHP code with relatively little work.

Now, depending on their specific situation, those relying on ancient versions like 7.3 or older may be forced to bring their websites' code up to speed, given that not all distros are bound to have backported fixes. For reference, PHP 7.3 came out in 2018. Making matters worse, nearly 8% of PHP installations are of version 5.x, which came out in 2005. Plus, a number of network appliances, NAS boxes, and similar hardware carries PHP within, and that too will need updating. Palo Alto Networks issued an advisory for products powered by its PanOS system, for example.

It's not all doom and gloom, however. Since the PHP Foundation published source code patches for 7.4 up to 8.1, most anyone can devise a patch for the older versions. Many entities did so, and there are packages available for Debian/Ubuntu flavors from Ondřej Surý (Debian developer) covering PHP 5.6 to 8.1. CloudLinux and AlmaLinux have likewise produced backported fixes.

This is one occasion where paying for extended support comes in handy, as commercial vendors like Ubuntu Pro and Zend released packages for positively ancient PHP versions, down to 5.5. Old website code is likely to have vulnerabilities other than the PHP engine, so a wholesale update-and-upgrade is much preferable, but very few CTOs will ever listen to that song.

Other options

Given how broad the problem is, and how it'll be a while before every machine is protected, there are a number of other means to mitigate the issue — though the proper fix is to update to a patched PHP version. Web application firewalls (WAFs) like Immunify360 may block malicious requests from even getting to the server in the first place.

Content delivery networks (CDNs) like Cloudflare or Fastly universally offer options for adding a WAF to their setup. Both firms immediately issued their respective notices and added detection of PHP2Shell to their respective rulesets. Finally, server-level security suites like CrowdStrike can also detect and block malicious activity by the PHP binary itself, in case an attacker tries something funny. It's reasonable to guess that these protections have slowed exploitation efforts.

So where are we?

Right now, the PHP2Shell exploit is doing the rounds, with at least one high-profile case involving a campaign that chained the PHP vulnerability together with Fragnesia (aka Dirty Frag) to eventually get kernel-level access to 25 servers seemingly linked to the U.S. government. As of October 29, security firm BitSight had recorded copious attempts of PHP2Shell intrusion across its monitoring fleet, from many distinct origins.

BitSight's dark web forum sleuths indicate that there was no one-size-fits-all exploit package available at that date. This may indicate that hacking campaigns for now are likely to be specifically targeted, but a proverbial one-click red button is bound to appear at some point, likely with a deeper exploit in tow, as with the Fragnesia example above.

Meanwhile, several cybersecurity firms kept a close eye on patching progress since the October 19 reveal. Censys has a real-time view, updated hourly, and suffice it to say that things could be going a lot better. The initial count estimated the number of vulnerable PHP installs at around 45.7 million, out of 119 million total.

The number of unpatched services has mercifully dropped to around 29 million as of this writing, seemingly indicating a patch rate of around 1 million per day, depending on how you count. It's worth noting that fix backports may not change the version number, so those instances could still count as unpatched.

But remember how most everyone toggled off their server's PHP version number reporting. According to Censys, 62% of PHP servers it's consulting aren't reporting that datum at all, so there's no telling what the actual totals might be. If history is any indication, a significant percentage of those machines remain unpatched today.

Google just shut down a massive botnet operation involving an OEM and ODM manufacturer. According to the company blog, Videostrong Technology Co., which was a certified Android TV partner, purposefully installed a backdoor into 1.3 million set-top boxes and then sold access to criminal affiliates. This allowed for the installation of hidden software that the bad actors could use to conduct ad fraud, build residential proxy networks, and even remotely install malware on the device itself to target the end-user.

“Videostrong monetized the backdoor by selling access to criminal affiliates and loading those affiliates’ malware modules onto infected devices,” the company said in the Google Cloud blog post. It also added, “We found this malicious software built directly into many different device models and brands over multiple years, supported by dedicated infrastructure and constantly evolving configurations to evade detection and manage their affiliates. We believe this campaign wasn’t an isolated rogue insider or a development oversight. As a result, Google has cut ties with Videostrong and banned them from making devices with preloaded Google apps.”

While Google did not mention when Videostrong started loading malware into its products, the company said that the pre-installed malware evolved into a complex, three-stage design in 2024. This meant that the manufacturer has been exploiting millions of devices for years now, with the latest developments designed to make the malware more resilient and allow for multiple bad actors to take advantage of the system. Even though the company has already terminated its business relationship with Videostrong, the open-source nature of Android means that it could continue using the operating system on its products.

There have been supply chain attacks in the past, wherein a third-party compromises a trusted product to steal data, like some Ledger hardware wallets that have been sold by a reseller in Southeast Asia and Europe. Although Google did not characterize this as a supply chain attack, as it was perpetrated by the manufacturer itself and not a third-party operator, it still compromised a supposedly trusted operating system, leading to millions of victims. This incident also shows how even the simplest of devices can be used to execute complicated attacks, like how a Chinese couple hid a PC behind a fridge in a Japanese hotel and targeted 2.4 million victims.

Hackers have struck Nvidia again, this time targeting its BREV cloud development platform, with users reporting unauthorized activity between October 4 and October 20. According to a notification sent to affected customers, some accounts may have been exposed. The company said it had investigated the incident and identified unidentified activity on the platform, adding that information stored on the platform may have been exposed to malicious actors. The said information included the SHH key set up by Brev.

The company has already replaced the affected SHH keys and updated customer machines with new ones but says they found no evidence of improper use. “We are writing to inform you that Nvidia Corporation has experienced a security incident that may have affected the security of your data," the notification reads. “Our analysis determined that your information from our Brev network may have been affected. This SSH key has since been rotated, and your instances have been updated with the replacement key.”

However, the company fell short of explaining how the attackers gained access, or whether anyone attempted to use the compromised data. Moreover, it has not disclosed whether customer data or workloads were accessed. SSH is a protocol used to establish a secure connection between ‘virtual machines’ or remote computers working together. Developers or system administrators can use it to manage remote servers, transfer files, and execute commands without needing physical access to the machine—much like AnyDesk or TeamViewer, but now for developers. Brev uses SSH keys to help customers access these services in the cloud, meaning if attackers access these keys, they could potentially take control of a virtual machine, depending on its specific permissions and other security controls.

The incident comes as several firms hosting AI development services and cloud infrastructure grapple with mounting security incidents involving customer credentials. On October 30, cybersecurity firm Wiz released a blog dubbed ‘Black October’ for AI developer platforms. The firm identified at least nine platforms that have had security incidents during the month, including Zeabur, Fireworks AI, Lightning AI, Opencode, Warp, Northflank, among others. As per the firm, the incidents were recurrent, with researchers noting that “all public reports highlight targeted exploitation, explicitly hunting stored environment variables, with a focus on those granted AI access.” Wiz further shared two cases involving compromised Amazon Bedrock credentials where, in one, attackers generated about 800,000 API calls over 30 hours while another key was used to make roughly 1.7 million calls over 13 hours. The combined usage came to a staggering $100,000 at list prices.

Such incidents are not just restricted to Nvidia, with major US banks including JP Morgan, Morgan Stanley and Bank of America restricting Agents from accessing customer accounts earlier this month. Their primary concern is that automated assistants could veer off set instructions and initiate unauthorized approvals. Similarly, the CyberCartel hacking group has previously used Anthropic’s AI tool Claude and Grok’s XAI to conduct attacks on more than 400 Latin American institutions, mostly targeting banks and mobile payments services after attackers obtained customer login credentials. China-linked attackers have also been accused of using AI agents in a ConnectWise supply chain attack that left about 2,250 Microsoft 365 tenants exposed, with some attacks reportedly reaching privileged access in under three hours.

Though updating compromised software may not be enough to eliminate an attacker’s access, Bradford Regeski, a threat intelligence analyst at RH-ISAC, has recommended extensive checks for customers in SHH-related incidents, asking users to “Isolate hosts that installed the compromised extension during the exposure window,” remove unauthorized SSH keys and persistence mechanisms, and rotate credentials and sessions.

The Russian Federal State Statistics Service (Rosstat) admitted that its servers were hit by coordinated cyberattacks between October 29 and 31. However, it denied claims that tens of terabytes of data had been leaked, as asserted by hack groups like the Belarusian CyberPartisans and Silent Crow. Rosstat stopped publishing annual cause-of-death statistics in 2024, but the hackers say that the huge new 23TB data haul includes data on Russian wartime losses marked “for official use only,” reports The Moscow Times. A new chart shared by the hack groups using the data suggests that as many as 50,000 Russian soldiers are killed every month.

Rosstat is very much like the U.S. Census Bureau and Bureau of Labor Statistics in the United States, or the Office for National Statistics (ONS) in the UK. It isn’t a big juicy military infrastructure target, but if accurate war casualty figures can come from the claimed exfiltrated data haul, then it would be a considerable win for Ukraine and its supporters.

As we mentioned in the intro, both the Belarusian CyberPartisans and Silent Crow claim to have snagged lots of sensitive data from the Russian government thanks to this breach. The former’s tweet includes evidence and a breakdown. “Entire IT infrastructure wiped: Domain controllers, databases, servers, virtualization, document workflow, workstations, admin consoles, VPN,” notes a follow-up post about the Rosstat hack attack. “Systems destroyed: STATEK, CSOD, Demography, SED, ESSO, OFSN, internal employee surveillance, StatRegister, websites and more.”

This is a developing story with the Belarusian CyberPartisans promising to share more sensitive information from Rosstat after they have picked through it. The Rosstat website was reportedly defaced with hacker messages and logos. Rosstat remains inaccessible at the time of writing.

We spotted an interesting graphic shared by the Belarusian CyberPartisans, which included the Silent Crow logo. A chart indicates that over the last two years, between 25,000 and 50,000 Russian soldiers were killed every month. The October 2026 figure is just a smidgen under 50,000, if this data leak news is genuine.

These same hacking groups have claimed responsibility for the likes of the disruptive Aeroflot IT systems hack, and a state real estate company hack with two billion records, both in 2025. “Both groups are designated as extremist and banned in Russia,” notes the report.

Update, Mon 2 Nov, 7 am ET: Reports are now emerging that supermarkets in Ireland, Estonia, and the Netherlands have also been affected by today's cyberattack. The rest of the story remains below as first published.

Just weeks after an 'unprecedented' cyberattack struck supermarket fridges in France, destroying foodstuffs, a similar hack has crippled supermarket chains in Belgium and Sweden, Bloomberg reports. Hackers targeted supermarkets owned by Dutch outfit Ahold Delhaize, as well as ICA and Coop locations in Sweden. As with the previous attack, hackers remotely raised temperatures in these online-controlled freezers to 50 degrees Celsius, rapidly defrosting their contents and likely destroying millions of dollars worth of items.

Belga News Agency reports that a cyberattack targeting refrigeration units at Belgian supermarkets started on Sunday night at around midnight. Sabcobel, a refrigeration fitter in the region, estimates that at least twenty units are affected across Belgium. The report says that affected supermarket chains include Delhaize, Carrefour, and Spar. As mentioned, and reflecting the previous attack, hackers remotely activated the freezer's built-in defrost mode, overriding the temperature and time spent defrosting, the exact same method as the France attack.

CEO Stephan Moelans said that while the company has been working "very hard" to protect its fridges against the vulnerability, physical modifications to its units are required. The company says switching units to a secure internet connection is the simplest solution in the meantime, a measure carried out by most of its customers in the wake of the France attack.

Elsewhere, supermarkets ICA and Coop are reporting similar disturbances in Sweden. Aftonbladet reports refrigerators and freezers have been struck "in several ICA and Coop stores." Pictures on the ground show staff throwing out shopping carts full of goods. "We are extremely sad and working hard to get everything back up and running," Ica Kvantum wrote on Facebook.

The attack, which is the second such instance in just a few short weeks, is a worrying reminder that many of society's most basic functions and infrastructure are heavily reliant on internet connectivity, making them vulnerable to cyberattacks. The increase in cyber intrusions into the physical world also seems to be commensurate with the proliferation of AI agents, which continues to heavily impact global cybersecurity. In October, a hacker suspected of using AI agents stole the data of 25,000 customers from banks in South Korea. Officials at the time commented that AI models mean actors can "hack with ease even without specialized skills."

A self-deleting Windows infostealer that calls itself VOLTA-AUTODOXER steals everything it can from a victim’s PC, then asks an AI model, Anthropic’s Claude by default, to turn the haul into a target assessment, Cisco’s Talos research organization reports. The malware builds a structured “evidence bundle” on the person and asks the model for a list of their valuables ranked by how much they could be cashed out for, to see what’s worth the effort. VOLTA operates with a prompt to act as “a forensic intelligence analyst” and to be “blunt, specific, accurate,” and can switch models if one refuses, or even do without.

VOLTA steals browser passwords, cookies, and saved payment cards, Thunderbird and Outlook email profiles, Roblox accounts, Microsoft OAuth tokens, screenshots, and even SSH and cloud-provider configuration files. Every saved Wi-Fi password gets pulled in plaintext. Cryptocurrency wallets, when present, are not just copied, as the malware attempts to crack their vaults inline. It then builds the evidence bundle on the person: geolocation and home address, employer and employer domain, inferred birth year, document authorship metadata, and the last four digits of their payment cards.

It also engages in live enrichment with any stolen sessions. VOLTA searches the victim’s Gmail for receipts from Amazon, DoorDash, Uber Eats, Grubhub, Walmart, and PayPal to confirm a home address, pulls Uber Eats and DoorDash order histories, reuses the stolen Discord token to fill in the victim’s profile, and values Roblox items through Rolimons. The theft list is relatively standard for a stealer, but this enrichment pass turns passive data into something dangerous.

The data is first assembled locally as Identity_Report.txt and serialized to JSON, before being POSTed to OpenRouter, a popular model router, with the system prompt. Any reply is saved as AI_Analysis.txt, and both are exfiltrated together in a volta_dox.zip archive file. This inference call happens over the victim’s own network connection. The model call asks for a concise assessment of the victim’s suitability as a target, backed by citations, with “opsec” to analyze overall security posture, including password hygiene.

The settings in use include Anthropic’s Claude Opus 4.6 by default, an older model released in February, at a temperature of 0.2. Temperature controls how random a model’s output is from a baseline 1.0, and the hardcoded low value suggests the operator prioritizes predictability. The author likely anticipates refusals, and VOLTA looks for refusal phrases and thin replies, switching to two other models, Moonshot AI’s Kimi K2 and Google’s Gemini 2.5 Flash, in that order. If the VOLTA user supplies no API key for OpenRouter, it can still send the dossier over Telegram without the AI data.

VOLTA appears to be a product designed for resale, as it has a template with six swappable slots — for a custom Telegram channel, API keys, and settings — that are filled at build time. The customer would supply the values, and a custom binary would be created. While the slot credentials are encrypted, it’s possible to recover them from the file. Assuming everything goes to plan with the delivered build, the customer receives ranked target assessments in their Telegram inbox without relying on any attacker-owned infrastructure; the chokepoints are on the services.

Much of the token theft relies on bypassing Chrome’s App-Bound Encryption (ABE), which VOLTA does by launching Chrome headless, that is, without a GUI. An application-control policy that limits which processes may launch Chrome headless blocks the ABE decryption path. This reduces exposure to VOLTA’s particular method of attack by denying it access to Chrome-stored sessions, but it doesn’t stop its other theft, the AI stage, or exfiltration.

After infection, the main executable may delete itself, but a volta_debug.txt file should be preserved by the victim. This file is a log that shows what was collected and whether the LLM call was successful. The target should revoke or rotate all API keys and tokens and change passwords, regardless of exposure; likewise, any funds in a wallet whose seed phrase was stored in plaintext should be moved to a new wallet with a fresh seed, preferably generated on an air-gapped device.

One very real concern is that VOLTA’s use of AI is relatively narrow compared with what is possible with fully AI-assisted malware, especially as models could be utilized for additional phases. Refusal resilience may become a standard design requirement for malware as AI integration matures. Already, a Windows malware implant reported in September was built around a panel of up to four LLMs that vote on its next move, and another, reported this week, can fall back to using the victim’s own OpenAI API key. This is still a process of having AI replace the work a human analyst would normally do, so the real question is which stage is next.

Security researcher Xusheng Li found that a Lenovo ThinkPlus FU100 fingerprint USB stick, sold as an AES-256-encrypted device for data security, ended up being just a plain SD card internally, HackingPassion reports. The fingerprint reader only enabled the USB connection, and nothing on the card was actually encrypted. An AI-assisted follow-up last week discovered what Li calls backdoor accounts on another maker’s drive, as well as hardcoded keys in other supposedly secure USB storage products.

The FU100 is “just an SD card in a fancy case,” Li said in a March conference talk. It is, as a result, trivial for anyone with physical access to get to the drive’s data. One of his takeaways: “‘Hardware security’ can be pure marketing.” This isn’t the first time drive makers’ own encryption has failed, and it won’t be the last.

The original ThinkPlus FU100 analysis happened last year, with an interim fix using epoxy over the card. A later fix by Lenovo, put out early this year for the FU100, FU200 and TU800 drives, as well as the TSD303 SSD, requires owners to call a China service line, then either send devices back for replacement or get an on-site firmware upgrade. Lenovo advises backing up data first and strongly recommends wiping the drive before sending it in, which is quite an inconvenience. Lenovo rated the advisory’s severity as high, and one of its three CVEs covers the configuration software, which could let a local, logged-in user bypass device authentication and enroll an untrusted fingerprint.

The same research also turned up a different flaw in Lenovo’s TSD303 external SSD. Its data actually was encrypted, but the drive sent the correct password back over USB in plain text for the software to compare, making it easy to capture. The first fix came three months after the initial report, using block cipher encryption with a key derived from a timestamp-like value. Lenovo’s software could derive that key, and the first software fix is vulnerable if taken apart, making it not useful for protecting data if a device is stolen. A later fix, late last year, has the drive check the typed password itself, so the correct one never leaves the drive.

The same software development kit used for the drive covered nine other devices from multiple vendors, most of which could also reveal passwords to a savvy actor. In addition, two left data unencrypted on a microSD card. The full list of vendors was blacked out on Li’s slides.

AI agent use for driving reverse-engineering tools continues to increase. AI has also been exposing more security flaws recently. Li used OpenAI’s Codex, an AI programming-centric tool, with his employer’s reverse-engineering tool against other vendors’ protection schemes. Netac’s tool took about seven minutes to break, as Codex found a fixed key built into the program, along with the user’s password written to diagnostic logs.

Copy protection differs from direct access, as the intent is to allow the recipient to view files, just not make copies of them. KakaSoft’s USB Copy Protection has an internal password the program builds itself, which Codex rebuilt to decrypt a test file without the user’s password in around 26 minutes. Nexcopy’s Copy Secure took about 10 minutes, with its key unlocked by a certificate built into the viewer app. Separately, SecZure’s YutianDun has two hidden “backdoor” accounts with simple passwords, discovered with time-travel debugging, stepping through a timeline trace. However, Li’s comments suggest that malicious intent cannot be assumed.

Li gave no warning to KakaSoft, Nexcopy, or SecZure, arguing that a drive already in an attacker’s hands can’t easily be recalled or updated. He said that “client-side validation is never secure” and you should always verify security claims on your own. Netac had no patch as of Li’s March talk. An example of things done right would be an open-source USB stick that does encryption properly, even though it is built on a microSD card, deriving its key from the user’s password, so reading the card alone gets an attacker nothing.

The U.S. Department of Justice (DOJ) just announced indictments resulting from Operation Ghostbusters, which investigated widespread student loan fraud. According to the agency, bad actors used stolen identities to sign up for student loans and used AI to complete the application, making it appear that the fake student was attending online classes.

While the schools receive the majority of the proceeds of the fraudulent student loan, the remaining amount is funneled into the bank accounts of the fraudsters, who then use mules to move the money from U.S. bank accounts to overseas conspirators. On the other hand, unwitting victims who have skipped college and instead directly joined the workforce after high school are saddled with student debt for a degree they never even signed up for.

Multiple community colleges and universities across the United States started suspecting fraud in the Federal Student Aid (FAFSA) program in 2021. Estimates suggest the U.S. government lost over $200 million because of this activity, and the U.S. Department of Education Office of the Inspector General referred the case to the FBI Richmond Field Office. Currently, more than 40 open fraud cases involve 26 FBI field offices and 20 U.S. Attorney’s offices. The DOJ called it Operation Ghostbusters, which has already resulted in the indictment of five individuals.

How much money are you willing to spend during the Black Friday sales?

“Today, we are announcing the first results of Operation Ghostbusters — a nationwide effort to stop a major fraud scheme targeting federal student aid, low-income Americans, and the American taxpayer,” Assistant Attorney General Colin M. McDonald of the Justice Department’s National Fraud Enforcement Division said in the statement.

“The Department is charging five defendants and announcing the seizure of more than $750,000 in cryptocurrency tied to this scheme through a network associated with Kenyan nationals. This is the first international seizure of its kind in Kenya. If you steal American identities, if you steal taxpayer dollars, if you exploit programs meant to help students build a future — we will find you. Whether you are in Nebraska, New Jersey, Virginia, or Nairobi, we will pursue you.”

While online fraud has existed since the birth of the internet, AI has let scammers become more sophisticated and target bigger payouts. One example is a scammer who used an AI-generated image of Brad Pitt to scam a 53-year-old woman out of $850,000. However, larger groups also use AI tools for their money-making schemes, such as North Korea, which has reportedly used AI to help its workers get jobs in Western companies and earn money to fund the nation’s coffers. The U.S. is taking steps to shut down student loan fraud by deploying automated fraud detection systems, but the added burden of identification and false positives is negatively affecting the country's most vulnerable students.

South Korean authorities have identified 80 Tesla drivers who allegedly forced Full Self-Driving (FSD) onto cars that were never cleared for it, Electrek reports. The Seoul Metropolitan Police Agency says it confiscated 21 of the devices used to switch the feature on. The unlock modules reportedly connect to the car’s CAN bus (the internal network that links its electronic control units) and get around the regional software lock that keeps FSD disabled. That works because Tesla builds the same computer into every car, whether or not the feature is approved locally.

Some suspects bought ready-made units from Europe and China, and one reportedly plugged a European-made module into his own Tesla. Others skipped the shopping. One suspect, an IT worker, built his device using information he found on GitHub, which suggests the barrier to entry for this kind of modification is lower than it sounds. The group also traded tips online, including how to stop the car from keeping any record that FSD had been activated. Concealing the activation history is likely an attempt to avoid detection by Tesla, which has been looking for these devices itself.

Then there is the legal risk, where prosecutors are using the Motor Vehicle Management Act, which bans unauthorized software changes that could affect vehicle safety. In Korea, the maximum penalty is two years in prison or a fine of up to 20 million won, or roughly $15,000, a steep price for a driver-assistance feature that many of these owners had already paid for.

South Korea’s transport ministry first flagged suspicious activations to police in April. “Safety risks were confirmed, including the possibility that FSD may fail to properly recognize driving conditions or operate differently from the driver’s intentions,” a police official said then.

Notably, the root of the problem is a certification gap. Tesla began offering FSD (Supervised) in South Korea in late 2025, but only on US-built Model S, Model X, and Cybertruck units, which skip local safety certification under the Korea-US free trade agreement. The Model 3 and Model Y arrive from Giga Shanghai and have yet to pass. Nobody agrees on how many Korean Teslas are eligible, although Carisyou Data Lab figures cited by MK last month indicate 47,458 of 229,311 cars (20.7%).

The South Korean investigation follows Tesla’s own efforts to stop unauthorized activation. In April, the company began remotely detecting unlock devices and disabling FSD access on affected vehicles. It has also warned owners that unauthorized modifications could void warranty coverage and leave them liable for crashes. Moreover, the restrictions are not the first time Tesla’s software protections have come under scrutiny. In August 2023, researchers exploited a hardware security flaw in the AMD processor powering Tesla’s media control unit to unlock certain paid features. The exploit targeted the car’s AMD-based system-on-chip, although researchers did not confirm that every premium feature could be unlocked.

Tesla has also faced regulatory scrutiny over software restrictions. In December 2021, the US National Highway Traffic Safety Administration investigated the company after an over-the-air update allowed drivers to play certain games while their vehicles were moving. The case highlighted how software changes can raise safety concerns when features are accessible under conditions regulators consider unsafe. Hardware reliability is another challenge for Tesla. Last year, the company detailed how it identifies defective processor cores in its Dojo AI supercomputers, where a single faulty component can compromise lengthy training runs.

Systems administrators are among the first to point out lax security policies in other companies' or people's setups. Sometimes, they are the ones who get bitten by not taking the same advice they will so readily dispense. Such is the tale of Reddit user NakamuraHwang, who had files on their Synology DS918+ NAS encrypted by a ransomware attack after making a series of unforced errors.

Hwang appears to be quite technically proficient and provided a detailed write-up of the situation. The key points, however, are that the unit in question (a) had its web interface exposed to the internet and (b) was roughly 18 months out-of-date with security patches. Just like the recent PHP snafu has adeptly shown, complacency is a far worse enemy than an army of AI bots.

The tech has a 3-2-1 backup setup, so they seemingly didn't lose any data. They attached the disks to a Proxmox machine for further inspection — Synology's DSM operating system uses mdraid underneath, so you can take the disks to another box and mount them there. Investigation of logs and the operating system files revealed that the attack was likely performed by abusing the CVE-2024-10441 remote code execution vulnerability, revealed a year and a half ago.

As most any other sysadmin will tell you, it's never advisable to expose devices directly to the internet without some layer of protection in between, chiefly but not only a VPN or an SSH tunnel. Tailscale, for instance, makes having a VPN fairly painless these days, and its free plan covers most home installations.

Synology had published its own advisory regarding the exploit, but that's where the NAS' behavior regarding updates complicates matters. According to multiple comments on the thread and in other forums, the UI will happily tell you that your device is up to date, all while there are critical security updates that need to be manually installed. The manual for DSM indicates that units from 2025 onwards have automatic updates, apparently implying that those of previous makes need to be configured so.

Furthermore, Synology apparently doesn't have a direct channel to warn its customers of critical security vulnerabilities —a simple e-mail notification would suffice. Although the firm is seemingly shifting away from consumer gear, it still sells small units that regular users might buy, and it's not reasonable to expect them to even be aware of security bulletins. Plus, package updates like the patch for the PHP2Shell vulnerability have to be installed separately, too.

Malicious GitHub repositories masquerading as two well-known and legitimate PS5 game emulation tools have been identified as spreading malware that steals gamers' passwords. The malware uses self-signed certificates, created using fake company names and on the same day the malware was built — suggesting that the malware campaign may be automated. Just two minutes after infection, a cleanup script scrubs the affected computer of the malware's files, leaving no trace that it was ever present, according to a report shared with Tom's Hardware by NordVPN's Threat Intelligence research team.

The campaign trades on the back of the popularity of two projects that have become popular within the PS5 emulation community. AnyPS5 is a portability layer that allows PS5 games to run as native applications on both Windows and Linux. Kyttyps5 is an emulator for running PS5 games on PCs, and both projects are freely available for download via their respective GitHub repositories. However, users who visit one of the malicious repositories posing as these tools are directed to download a zip file containing a Windows executable. Notably, the GitHub repositories used as part of the malware campaign rapidly rotate, and it's possible that GitHub is not the only source.

The malicious executable unpacks a hidden application before launching its own multi-stage loader. It first checks whether the PC is a legitimate machine or a security researcher's sandbox by checking if less than 2GB of RAM is available, if it's a virtual machine, if it's running on a cloud-based server, or if it doesn't have a physical GPU installed. If any of those criteria are met, the loader exits silently. If the machine is deemed to be a legitimate target, the malware adds exclusion rules to Microsoft Defender to ensure that it will never be scanned and identified during an antivirus scan. Finally, the payload is decrypted and executed.

That payload, we're told, is an executable protected by a commercial packer that is believed to be an infostealer — a type of malware whose job it is to steal passwords as well as any other sensitive data that it comes across.

While this appears to be a relatively new malware attack, there are some steps that you can take to avoid falling foul of it. If you're trying to download tools like AnyPS5 and Kyttyps5, it's vital to ensure that the repository belongs to the official project team. Double-check the owner of the project, look for download links that use third-party destinations, and check metadata like the project and files' creation dates.

If you do find yourself in a position where you have accessed a suspected malicious download, disconnect your computer from the internet and run a full antivirus scan. It's also recommended that you change your passwords from a separate device where possible.

PS5 emulation is likely to become more popular than ever once GTA 6 is released on November 19, 2026. The game will be a console exclusive at launch, with a PC version expected to arrive in early 2027.

Discover-Tech, an Israeli advertising technology company, has reportedly been linked to a suspected surveillance effort aimed at Starlink users, according to Reuters. The report, which cites six people familiar with the matter, claims the firm was the top bidder for ad space tied to Starlink traffic in more than 100 countries. Researchers suspect the aggressive bidding was meant to reveal where users are located or to enable further monitoring — though the findings do not show that anyone was actually tracked.

The data comes from TrendAI, the research arm of Trend Micro. Its October 15 report referred to the activity as ‘Shadow-Earth-79’ without naming a company, but the report claims the codename belongs to Discover-Tech. TrendAI says its attribution process is designed to avoid ‘hype-driven labels’ that could mislead security teams. “Our approach reduces the risk of misattribution, hype-driven labels, and unstable actor names that can mislead defenders, distort risk prioritization, and trigger inappropriate response actions.” The report says.

The method exploits how online ads are sold with advertisers bidding in real-time auctions for space on websites and in apps, and each bid request can carry details about the person on the other end. Collected over time and combined with other data, that information could be used to identify people, follow their activity across the web, or select targets for spyware.

The geography is what raised eyebrows. Shadow-Earth-79 was reportedly the largest ad buyer in Syria, Libya, Yemen, and South Sudan, and the second largest in Afghanistan, while also claiming unusually large shares of bids in Hungary, Israel, Egypt, Azerbaijan, and Venezuela. TrendAI says the pattern points to ‘targeting and tracking infrastructure rather than a commercial advertising operation.’ That is plausible, given how little legitimate Western advertising demand exists in sanctioned or war-torn markets.

Notably, Discover-Tech was already under scrutiny. On the same day as TrendAI’s report, Citizen Lab and ad security firm Confiant separately named the company, alleging that it used ad auctions to collect data on users across sensitive networks, including those tied to media organizations, governments, and tech firms. “The malicious advertisements were purchased by Discover-Tech, an Israeli company that presents itself as a legitimate advertising company, but which we found operates as a facilitator for multiple mercenary spyware partners.” Citizen Lab wrote.

Google and Comcast have since said they removed Discover-Tech from their advertising platforms, while the report says that a major U.S. technology company and an international organization have opened internal inquiries into whether the firm’s ads targeted their employees.

For Starlink, the stakes are obvious — the service works outside conventional telecom networks, which makes it a lifeline where governments restrict internet access, and makes its users an attractive target for those same governments. In April, Iran’s nationwide internet blackout passed 1,000 hours, with authorities reportedly going after Starlink terminals and imposing severe penalties for possessing one. Earlier this month, SpaceX also limited Starlink service for Ukraine’s high-speed military drones, which Ukrainian officials say complicates logistics and operations.

Advertising and consumer tech have been abused for tracking before. A backdoor was previously found in a popular iOS ad library that could collect device-location data and capture screenshots, while Chrysaor, Android spyware linked to the Pegasus family, was discovered by Lookout and Citizen Lab on a small number of devices. More recently, a researcher claimed to have found extensive data collection, including ad-related telemetry, inside a Samsung smart TV’s Tizen operating system, though those findings are still being investigated.

That said, it is still unclear if Discover-Tech actually used Starlink-related data to single out specific subscribers remains unverified, and neither the company nor SpaceX has commented.

The AI-powered inrush of software vulnerability reports over the last year has shined a light on how many critical pieces of open-source software are chronically underfunded. The latest victim is PHP, the scripting language powering about 71% of websites, making the news due to a critical remote code execution vulnerability. The PHP Foundation, which develops and oversees the language, reportedly counts only one full-time person and 14 "mostly part-time" contractors. That's bad enough, but the real problem goes far deeper thanks to the internet's lazy development practices and systems administration.

In an interview with Reuters, the PHP Foundation's Executive Director Elizabeth Barron spells it out clearly: she's the only full-time person on staff, and works with the contractors' help. Pertaining to the software itself, the team's job is to develop and maintain the PHP core, including taking care of security fixes. The core team accepts contributions from the world at large, in an arrangement not too dissimilar to Linux kernel development — except that project is far better-manned, with many full-time contributors and company-employed developers.

Naturally, the PHP foundation collaborates with other companies and many cybersecurity firms, but the dev team was stretched thin even before the increase in security vulnerabilities with the help of countless AI agents. Barron does note that there was no reported exploitation of PHP2Shell before the security fix came out.

But the lack of a higher funding level likely led to the "structural failure" to address the underlying vulnerability in a timely manner, as the out-of-memory condition (OOM) that eventually led to the 2026 exploits was originally discovered in 2024. Given how widespread PHP is, and how many third-party extensions there are, the work on fixing the OOM problem "stalled and restarted repeatedly over months." It didn't help that the Chainguard security firm broke the PHP2Shell embargo too early by accident.

Even still, the team is thankful for the money it has, as "without the Foundation’s funding it would have been impossible to have multiple people work on this issue full time, eventually through weekends and around the clock to coordinate and communicate with other involved parties." One would hope that this latest incident releases the purse strings of more companies that make their living off of PHP.

And yet, this failing is far larger than just bugs in the core language, which, notably, were only one point update away. In theory, any server running the current 8.x brand of the software should be upgraded in minutes with the released patches, but reality was far different, as websites went down for hours or days out of fear of exploitation.

The real problem reared its ugly head: nearly 73% of PHP installations were running versions well past their end-of-life (EOL) date, meaning that obtaining fixes is now far harder. Many professionals who worked with the language, including yours truly, had spent decades warning of this reckoning, even considering many Linux distributions were backporting fixes.

Many of these servers were still running PHP 7, a version that was completely EOL'd four years ago, with many years of advance warning, and that originally came out in late 2015, almost eleven years back. If that doesn't sound silly enough, let it sink in that around 7.7% of PHP sites were still running version 5.x, which first saw the light of day 22 years ago in 2005, and saw the final sunset in 2018. It's safe to say that everyone had plenty of time to prepare.

To further illustrate the ridiculousness of collective complacency: the jump from PHP 5 to 7 and then from 7 to 8 required changing sections of website code, but the vast majority of said changes are simple to find and apply, and even before AI, there were already automated code-patching tools around. A couple years ago I mapped them all out for a PHP 5-to-8 codebase conversion myself.

Most of the alterations were about dropping support for ancient functions and libraries, which themselves had had long-standing warnings of incoming deprecation. Not a lot of core language features underwent modification, and a lot of convenient syntax was added to help clarify fiddly, error-prone code, too. That the overall situation got to this point beggars belief and illustrates how complacency, laziness, and cost-cutting are a far bigger force than a cadre of AI bots digging for flaws.

Reverse engineer and cybersecurity bounty hunter log4j recently found they were getting “weirdly targeted ads” on their Samsung TV and discovered privacy breaches. As they live-tweeted their discoveries, they found increasingly concerning code in the Tizen operating system, including detailed user telemetry from packet logging, audio categorization, screenshots, cross-device identification for ad tracking, and more, all designed to extract as much user information as possible to improve targeted ads.

log4j posted on X that they were concerned with how specific the ads on their 2025 Samsung TV were. They decided to reverse-engineer the Tizen OS on their TV to see what it was doing—they “discovered PRIVACY HORROR,” log4j states, marking the start of subsequent posts sharing more concerning findings.

The tester theorizes that Samsung TVs are so sluggish because they do a lot of post-processing of user data, including audio, screenshots, and AID (a cross-device tracking ID for ads), plus computer vision processing and models running on the TV. The hacker even found a region-specific convolutional neural network (an AI) that tracks user behavior, citing examples like what videos the user watches, which ads are skipped, and video progress. Log4j also found behavior for TVs without microphones, stating it will find connected devices with microphones, such as a soundbar or a connected Bluetooth device, to record audio.

Hugging Face engineer ngxson commented that they would test the microphone behavior using their Flipper Zero and found that the TV opened the microphone for five seconds, then stopped. ngxson waited for another microphone response but found none hours later. However, ngxson explained that their Tizen TV was already rooted and had multiple settings disabled, so an unmodified TV may behave differently.

What hardware deals are you hoping to pick up during Black Friday?

The hacker used OpenAI tools to hack the TV, but the company eventually banned them for cyber abuse, as stated in an email they received. log4j defended themselves, saying they never used OpenAI’s tools to exploit or find vulnerabilities, only for local reverse engineering, and that they didn't breach the terms of use. In a comment below their post about the ban, log4j said it seemed OpenAI banned their account because of a primitive classifier.

However, Samsung TVs and Tizen aren’t the only culprits in reportedly breaching user privacy; other brands like LG have also been accused of spying on customers. Many owners have also reported their TVs slowing down despite no new features or heavy apps running, suspecting it is mainly bloatware, but it could also be the spying behavior Log4j found. The hacker is also working on a comprehensive write-up of their findings, including how others could do it themselves.

At the end of the post series, they jokingly say they “finally found a company that truly listens to its customers.”

The FCC recently imposed a new rule allowing it to ban devices based on the internal chips instead of basing bans on individual products or brands, thus closing the loophole of rebranded products with parts from Chinese manufacturers on US export restriction lists. Using this new rule, the FCC has banned two devices from being sold and marketed in the US for the first time: a dashboard camera and a wireless video transmitter. As reported by The Verge, these devices were banned due to the HiSilicon Smart Vision SoC (System on a Chip) they contain, which features built-in detection algorithms for faces. HiSilicon is a subsidiary of Huawei, and the firm and its subsidiaries are on the FCC’s Covered List of entities that pose a risk to US national security.

The Hi3516CV610 UHD Smart Vision is an SoC for surveillance and camera products. The SoC is meant to be used for things like vehicle dashcams and wireless CCTV systems; fully equipped with WiFi, Ethernet, video encoding chips, an Arm Cortex-A7, and an NPU (Neural Processing Unit) for AI features. The NPU is what the FCC is concerned about, explaining that it is a device that contains logic-bearing “smart” components produced by entities on the Covered List.

On the SoC’s data sheet, the Intelligent Video Engine (IVE) uses the NPU that runs a built-in dedicated multimodal large model and transformer feature acceleration. The transformer feature acceleration allows the AI model to understand the relationship between objects from one video frame to another, keeping “attention” between related objects: pets, faces, human figures, and parcels, as the data sheet advertises. For consumers, this potentially means the AI in a surveillance camera can understand whether it is your pet that is escaping, or an unknown person is stealing your parcel after understanding that it was placed by a courier worker.

However, the FCC believes the logic-bearing AI in the SoC can do something much more nefarious, surveying US citizens and logging faces for foreign surveillance. Huawei already had a previous AI chip scandal, using shell companies to deceive TSMC into producing AI chips for them, going against the US’ request for TSMC to halt supplies to a list of Chinese customers; among other Huawei scandals leading to other product bans in the US.

A new report claims that major U.S. banks have now detected AI agents accessing customer accounts, and that some are even attempting to make transactions. Axios reports that it’s hard to differentiate between an actual human and an unauthorized bot, which is why some institutions, including Morgan Stanley, Bank of America, JPMorgan, and Wells Fargo, are blocking the technology and changing their terms of service to account for this.

While an AI agent or AI assistant can access an account with a user’s permission and through the use of their login credentials, this often goes against bank policy that requires users to maintain control of their account and not share it with anyone else. One of the fears that executives have is when an AI agent with login access takes unauthorized steps, like spending money or moving funds around without the explicit instructions of the account owner. There have even been situations where an AI agent called the bank directly and took actions independent of direct user command. Even though it wasn’t explicitly told to do that transaction, it considered it a crucial step to accomplish the task assigned to it.

One hypothetical example of this is when a user tells an AI agent to purchase an item but gives it a credit card with no available limit. The AI agent could then have accessed the user’s bank account to move some funds from whatever account it sees that has available funds to then effect the transaction, even if the user did not explicitly tell them that they could use the money in that said account. This is just one example where an AI agent’s transaction could go wrong, which is why several U.S. banks are now restricting third-party AI agents from accessing their platforms. Nevertheless, they still recognize that their customers might want to use tools like AI agents to monitor their finances. This is why some institutions have given or are moving towards read-only access for AI agents, which is something that they’ve been doing for years already.

The move comes against a background of burgeoning AI agent use, coupled with the risk that agents can and often do act beyond their remit, making mistakes or performing tasks without instruction, often with disastrous results. An unsupervised AI agent recently deleted a TV show's entire edit weeks before broadcast, forcing the program off air. AI agents are notorious for deleting databases and directories, making it a small leap to imagine they cause some havoc with unfettered access to a bank account.

Financial institutions have deep experience when it comes to employing new technology while ensuring that their critical infrastructure remains safe — something that AI labs lack, according to a former OpenAI safety employee. Despite that, banks are still concerned about the speed at which AI technology is developing, fearing that the technology’s capabilities might outrun their ability to control it, which is why they’re preparing for worst-case scenarios and even planning for “day after” scenarios after a catastrophic AI event.

A Hacker News user who shared news about the recent PHP vulnerabilities revealed by ChatGPT Sol before an embargo, which they claimed to be unaware of, has taken to the platform to apologize for the post. According to petecooper, they shared the CVEs because they wanted to alert others who follow the four-week PHP release cycle about the importance and urgency of the matter, but they weren’t aware of the news blackout that went with the two identified vulnerabilities.

The user said they have "No connection or affiliation to any of the organisations involved." Noting, "I am a self-employed consultant for my day job, and a solo founder of a mental health non-profit on the side." Petecooper's original post about the vulnerability was among the first to break the NDA, though they claim they were unaware.

“I posted here about the then-upcoming PHP RCEs related to CVE-2026-109618 & CVE-2026-109619. I appreciate this has had considerable knock-on effects with the schedule for co-ordinated disclosure, and created additional workload. I am truly sorry. I take full responsibility for my actions,” petecooper wrote on the platform. “It was not remotely my intention to cause any of the subsequent side effects. At the time of posting, I didn’t know about any embargo. My contact had told me there was no embargo, and her contact had told her the same thing.”

CVE-2026-109618 and CVE-2026-109619 are two critical vulnerabilities, both scored at 9.2. It seemed that the PHP Foundation planned for a controlled public release, allowing affected websites and applications to be patched before the vulnerabilities became widely known. Unfortunately, it seemed that some recipients of the warning failed to share the embargo that came alongside the CVEs, spreading the news earlier than expected.

It should be noted that petecooper apparently wasn’t the only one who leaked the news early. Multiple leaks had already been circulating on social media and other platforms, which forced the PHP Foundation to move its announcement up by one day. Despite that, the organization mentioned that Chainguard broke the embargo by more than six hours. Dan Lorenc, the co-founder and CEO of Chainguard, defended the move on LinkedIn, saying that he made the call after talking to several other researchers and immediately notified the group after releasing the fix publicly, and not just his customers.

The vulnerabilities tracked as CVE-2026-109618 and CVE-2026-109619 were bugs in the PHP runtime itself that were discovered using AI tools, not attacks by rogue AI. Still, the abilities of this technology could make it easier for both security researchers and bad actors to find vulnerabilities that could have been lurking in widely used code for years, if not decades. This makes it a race to find and deploy a fix before they can be exploited.