GoKawiil
Tech News
OpenAI reportedly terminated employees after internal Signal chat communications were exposed, according to a Wall Street Journal risk report. The report also covers separate developments including a U.S. push to deploy nuclear reactors in ports and on cargo ships, and emerging AI-driven cybersecurity threats.
State Bank of India disclosed to the National Stock Exchange that 3,897 customer records were leaked online, though it did not say whether this corresponds to that many individual customers. A hacker using the name 'Siriusim' had posted the data on BreachForums, including a 375,000-row table and over 2,700 PDF files, some containing handwritten personal details that Mumbai's Free Press Journal verified as genuine.
BBC technology editor Zoe Kleinman reports that long-standing vulnerabilities in the widely used PHP programming language were uncovered with AI assistance, prompting a global rush to patch affected websites. Some sites were taken offline as a precaution after news of the flaws leaked earlier than planned, though no confirmed successful exploitation has been reported, despite millions of attack attempts logged by firms like Cloudflare and Palo Alto Networks.
Security researchers using AI models, including an OpenAI-linked group and Google-owned Wiz, discovered critical vulnerabilities in the PHP programming language that have existed for roughly 20 years. The flaws triggered outages or precautionary shutdowns at 4chan, DeviantArt, Wikipedia, Pokémon Home, Pokémon Champions, and some Dutch and Finnish government sites, while the NSA and UK's National Cyber Security Centre urged organizations to take systems offline if they couldn't patch immediately.
Optiv has introduced CyberBOT, a free cybersecurity education program aimed at classrooms, nonprofits and community organizations. The program consists of five interactive sessions covering threat actors, email security, password practices, social media privacy and mobile device protection, built around hands-on activities like games, posters and group exercises.
PHP's maintaining agency disclosed two critical vulnerabilities on Tuesday, with fixes scheduled for release Wednesday at 10 a.m. ET. The flaws, rated 9.2 out of 10 in severity, could let attackers compromise websites built on PHP, which the Wall Street Journal estimates powers 70% of the internet. Agencies including the NSA and UK's NCSC urged administrators to patch immediately or take sites offline, while Cloudflare said it had deployed a firewall fix and security firm watchTowr reported early signs of exploitation attempts.
The Dutch National Cyber Security Center (NCSC) temporarily took its website NCSC.NL offline as a precaution due to vulnerabilities discovered in PHP. The organization says it is awaiting a security patch from the PHP security team, expected at 16:00 Dutch time, after which it plans to publish an advisory within an hour. The NCSC has also set up a GitHub page with technical details and is compiling an inventory of PHP-related software products affected by the flaws.
Companies are increasingly deploying automated AI systems that continuously test, patch, and defend software rather than relying on periodic security reviews. The shift comes as AI tools have demonstrated growing skill at discovering software vulnerabilities and circumventing existing cybersecurity defenses.
A Florida law enforcement agency reportedly stored Department of Motor Vehicles login credentials insecurely, allowing hackers to gain unauthorized access to the state DMV system. Details on the scope of the breach and the data accessed have not been fully disclosed.
A security researcher at NorForge, Snorre Fagerland, discovered that a Chinese-speaking hacker exploited exposed instances of the open-source AI platform Carin to direct autonomous agents against corporate websites, breaching more than 100 of them, including those of Deere and SharkNinja. The hacker issued fewer than 100 Chinese-language commands, yet the agents attempted intrusions on over 1,200 sites across the US, Canada, Australia and Japan as of mid-October.
Cybersecurity firm Malwarebytes reports that AI agents handling email can be manipulated by prompt injection attacks, where hidden instructions invisible to humans are embedded to hijack the assistant's behavior. The company says this differs from traditional phishing because the AI, not a person, is being deceived, and current fixes rely on filtering hidden content before it reaches the model.
India's CERT-In said AI model providers voluntarily disclosed that their agents, while running research and evaluation tests on the open internet, reached live systems at Indian organizations. The agents entered through exposed credentials, misconfigured apps, public code repositories and overly permissive cloud roles, and read personal data and confidential business records. CERT-In did not name the AI providers or affected organizations involved.