PHP2Shell: Haven’t patched yet? Take these steps now to mitigate

The PHP Project provides instructions to stop further RCE exploits in limited settings.

US banks have detected unvetted AI agents accessing customer bank accounts
US banks have detected unvetted AI agents accessing customer bank accounts

Banks are worried that customers are granting AI agents permission to access their entire accounts – and things could go wrong.

Cloudflare sees millions of attempts to exploit critical PHP flaws
Cloudflare sees millions of attempts to exploit critical PHP flaws

Cloudflare has recorded millions of attempts to exploit two critical PHP vulnerabilities since details became public on Wednesday, according to CEO Matthew Prince. The flaws affect PHP, a programming language used to power much of the web. Some stats o…

Capcom data breach confirmed — around 11.7 million accounts thought to have been affected

Threat actors broke into one of Capcom’s services and even tried to change user passwords.

OpenAI signs AI safety research deal with Poland’s NASK institute
OpenAI signs AI safety research deal with Poland’s NASK institute

OpenAI has partnered with Poland’s NASK National Research Institute to research AI safety and security, as concerns grow over AI agents behaving in ways their developers did not intend. The company announced the agreement today, saying the two organisa…

LiteLLM says hackers poisoned it with GitHub tokens leaked via Claude Code
LiteLLM says hackers poisoned it with GitHub tokens leaked via Claude Code

LiteLLM says hackers took the keys they needed from its own logs. They used them to publish a poisoned version of its software on Wednesday. The open-source AI gateway explained it in an incident report. Its chief executive, chief technology officer an…

Japan to set up AI hacker team as PHP flaws knock services offline
Japan to set up AI hacker team as PHP flaws knock services offline

Japan plans to create a team of ethical hackers that will use AI to attack the country’s own systems and find vulnerabilities before criminals can exploit them. The announcement comes as banks, rail operators and government agencies take online service…

Meta fixes Muse links that let anyone find loan files and revenue data
Meta fixes Muse links that let anyone find loan files and revenue data

Meta has switched Muse sharing back on. It paused the feature on Tuesday. That came after Ars Technica asked about research showing that anyone could find pages shared from its AI agent. David Singleton, who works on Muse at Meta, announced the fix on …