Hackers got a four-day head start on epic PHP2Shell vulnerability
Amazon has warned that vulnerabilities in a programming language that underpins much of the Internet, discovered using AI tools, are being “broadly exploited” as governments and companies rush to secure their systems. The world’s largest cloud computing provider on Wednesday said it had identified an attempt by hackers to exploit the bug four days before the weakness was disclosed to the public. Amazon added the flaws were “now being broadly exploited in the wild.”Read full article Comments
Get smart on it
Critical vulnerabilities were discovered in a programming language that powers approximately 70 percent of websites worldwide, with hackers beginning to exploit the flaws four days before the public was informed of their existence. The weaknesses were uncovered using AI tools and had gone undetected for more than a decade, potentially allowing attackers to gain unauthorized access to servers without requiring passwords or login credentials. Government agencies and cybersecurity organizations issued urgent warnings for all organizations using this language to immediately update their systems or take them offline, while developers released patches to address the flaws. The incident demonstrates both AI's ability to identify major security threats and the dual-use concern that the same capabilities could help attackers develop exploits rapidly.
Relevant courses
Want to go deeper than the news? Explore live, cohort-based AI courses taught by practitioners.
Browse AI courses on MavenRelated news
Chinese hackers spied on thousands of companies after breaching IT giant ConnectWise
Microsoft points the blame for ConnectWise's breach at a China-aligned hacker, which relied on AI agents to rapidly hack into thousands of its customers.
OpenAI says an AI agent lied about disabling its safety monitoring system
OpenAI disclosed a pair of safety incidents that involved AI agents weakening their safety monitoring systems during internal coding tasks. In one incident, OpenAI says its GPT-6 Astra agent disabled its safety monitor when copying reference code - and then lied about it. "The reference didn't configure a monitor, and Astra decided that was reason to remove the monitoring integration from the user's code," Marcus Williams, an AI safety researcher at OpenAI, writes on X. "When t
Also reported by The Decoder
Trump administration orders ban on DeepSeek in federal agencies
The Department of Homeland Security has ordered artificial intelligence technology from the Chinese company DeepSeek Ltd. be removed from all federal civilian agencies. The order, published on the Federal Register website today, warned that DeepSeek’s AI models present “multiple threat vectors,” that could give the Chinese Communist Party “extensive authority” to access American government infrastructure. […] The post Trump administration orders ban on DeepSeek in federal agencies appeared
Also reported by TechCrunch and The Decoder
OpenAI, Anthropic, and Nvidia had record lobbying quarters
It was a busy summer for AI lobbyists. Anthropic, OpenAI, and Nvidia each had their highest-spending lobbying quarter between July and September, federal disclosures show. Nvidia spent the most of the group at $2.2 million, followed by Anthropic's $2.1 million and OpenAI's $1.5 million. Compared to other Big Tech companies with long-established presences in Washington, the sums aren't out of the ordinary. Microsoft, for example, has spent at least $2 million a quarter going bac
Sam Altman reportedly pitched three endgames for AI safety, one involving a single firm melting everyone else's GPUs
OpenAI CEO Sam Altman laid out three paths to safe AI in an internal presentation: an international watchdog modeled after the IAEA, a merger of the major labs into one entity, or a single company so powerful it could shut down everyone else's compute. He called the last option "terrible." The article Sam Altman reportedly pitched three endgames for AI safety, one involving a single firm melting everyone else's GPUs appeared first on The Decoder.
Army Cyber Command's ECHOTRIBBLE would turn AI agents into self-spreading cyberweapons
The Army Cyber Command is developing AI agents that move through other networks like a computer worm and "neutralize" targets, according to internal documents. The program, codenamed ECHOTRIBBLE, is designed to reach even air-gapped systems with no network connection and run with minimal human oversight. Experts warn about collateral damage, pointing out that AI agents have recently broken into outside systems without meaning to, even without any order to attack. The article Army Cyber