On October 16, 2026, NIST, CISA and the NSA jointly released a 14-page voluntary guide titled Key Practices for Incident Readiness and Response in Super Intelligence Training and Evaluation. The document outlines ten practices across five stages—prepare, detect, respond, recover and report—aimed at organizations training or evaluating highly autonomous AI agents, and defines a 'control incident' as significant agent actions not directed by an operator or adversary that undermine oversight or policy.
bleepingcomputer.com
· 2026-10-26
Amazon reported it detected hackers attempting to exploit two vulnerabilities in the PHP programming language four days before the flaws were publicly disclosed, and said exploitation is now widespread. The US NSA and UK authorities separately warned organizations running PHP to patch immediately or take systems offline, and PHP's maintainers have released fixes. The bugs reportedly went undetected for more than a decade and were found with help from OpenAI and Google AI models.
arstechnica.com
· 2026-10-22
Researchers at AI firm Calif and Google's Wiz discovered a set of vulnerabilities, dubbed PHP2Shell, affecting all PHP installations serving web requests, using AI tools including OpenAI's GPT-5.6 Sol and Google's Gemini 4 Argon. The flaws allow unauthenticated attackers to remotely execute code on PHP servers, prompting the NSA to urge organizations to patch immediately or take servers offline, and causing some European government websites to go dark. A proof-of-concept video accidentally posted by Calif leaked details early, forcing the PHP Foundation to fast-track patches originally planned for release a day later.
cnbc.com
· 2026-10-22
Security researchers and AI models independently discovered two critical vulnerabilities in PHP, the scripting language used by roughly 70% of websites, in mid-August. The flaws can let attackers directly access a site's underlying file system or database, and Amazon Web Services says they are already being widely exploited. The NSA has advised organizations to take unpatched PHP-based sites offline until they can apply fixes, prompting many commercial and government sites to go dark this week.
9to5mac.com
· 2026-10-22
A wave of cybersecurity incidents struck simultaneously: AI-discovered PHP vulnerabilities took government websites offline and prompted an NSA advisory to patch or disconnect affected systems. Node.js patched four high-severity bugs including a remote code execution flaw and TLS bypass issues, while LiteLLM confirmed its packages on PyPI, Docker Hub and GHCR were compromised with malware that stole credentials and enabled remote access. Separately, certificate authority eMudhra had private keys compromised, raising concerns about fraudulent website certificates.
techcrunch.com
· 2026-10-21
The NSA issued an alert on two severe vulnerabilities in PHP, the server-side language that underpins roughly 70% of websites, including those running WordPress. The flaws, present since PHP version 5 in 2004, let attackers access a server's file system or database, and the PHP Foundation has already released patches, recommending an update to PHP 8.5.12. The bugs were uncovered through AI-driven security research: one by Calif using OpenAI's GPT-5.6 Sol under its 'Patch the Planet' program, and others by Google-owned Wiz using its Atlas agent alongside Gemini 4 Argon and GPT-5.6 Sol.
techcrunch.com
· 2026-10-21
Security researchers using AI models, including an OpenAI-linked group and Google-owned Wiz, discovered critical vulnerabilities in the PHP programming language that have existed for roughly 20 years. The flaws triggered outages or precautionary shutdowns at 4chan, DeviantArt, Wikipedia, Pokémon Home, Pokémon Champions, and some Dutch and Finnish government sites, while the NSA and UK's National Cyber Security Centre urged organizations to take systems offline if they couldn't patch immediately.
theverge.com
· 2026-10-21
PHP's maintaining agency disclosed two critical vulnerabilities on Tuesday, with fixes scheduled for release Wednesday at 10 a.m. ET. The flaws, rated 9.2 out of 10 in severity, could let attackers compromise websites built on PHP, which the Wall Street Journal estimates powers 70% of the internet. Agencies including the NSA and UK's NCSC urged administrators to patch immediately or take sites offline, while Cloudflare said it had deployed a firewall fix and security firm watchTowr reported early signs of exploitation attempts.
cnet.com
· 2026-10-21
Anthropic reports that its Claude AI model helped determine the origin of mysterious 'seed' values used to generate NIST's standard elliptic curves for ECDSA, a widely used cryptographic signature standard. The seeds, published without explanation by the NSA in 2000, were long rumored to derive from a humorous passphrase chosen by NSA employee Jerry Solinas, but the analysis found they actually correspond to UTC timestamps.
anthropic.com
· 2026-10-16
Cindy Cohn and Bruce Schneier trace how post-9/11 mass surveillance infrastructure, originally justified for counterterrorism, has expanded into routine domestic policing, immigration enforcement by ICE, and private security systems like facial recognition and license plate readers. They highlight that government agencies increasingly rely on private companies' data—including purchasing information directly from data brokers, as confirmed by FBI Director Kash Patel—rather than going through traditional legal channels.
lawfaremedia.org
· 2026-09-15
The NSA, CISA, and FBI jointly identified six Chinese AI companies—DeepSeek, Moonshot AI, Alibaba, MiniMax, StepFun, and Z.AI—as running large-scale campaigns since late 2024 to extract the underlying capabilities of leading US AI systems like Claude, GPT, Gemini, and Grok. The agencies said these firms likely operated with the Chinese government's awareness and used tactics such as mass fake-account API abuse and prompt injection to expose hidden reasoning processes.
arstechnica.com
· 2026-09-09
The NSA, CISA, and FBI issued a joint advisory alleging that Chinese AI companies, including DeepSeek and Moonshot AI, have run large-scale campaigns since 2024 to extract capabilities from leading US models like ChatGPT, Claude, Gemini, and Grok. The agencies say these firms used millions of queries routed through multiple accounts, APIs, proxies, and cloud providers to generate synthetic training data and build competing models such as DeepSeek's R1/R3 and Moonshot's Kimi-K2/K3.
slashdot.org
· 2026-09-08
GoKawiil