The exposure was immense, with AI multiplying the risks — and yet time-tested global cybersecurity procedures appeared to be functioning. Then suddenly, it all broke down.        

The decision by a cybersecurity company on Wednesday to prematurely release information about a flaw in the popular PHP computer programming language left much of the web exposed to hackers, triggering a panic that brought to life months of warnings of how the AI-powered era could cause widespread damage.

The flaws in PHP, discovered using AI tools through a months-long process coordinated by OpenAI, caused cyber agencies across Europe, the U.S., the U.K., Australia and Canada to post urgent warnings Wednesday. Numerous governments took websites offline as a precaution.

While no major hacking damage was immediately apparent, the way the incident unfolded over 72 hours showed how easily cybersecurity processes can break down and the outsized consequences of cyber risks in the AI era.

The man who set off the chain reaction with the early release — Chainguard’s CEO Dan Lorenc — quickly apologized in a LinkedIn post. But on Thursday, in an interview with POLITICO, Lorenc said he’d shared the information ahead of time because the flaw was already being exploited. Though others disputed that, Lorenc said he believed he’d seen enough evidence to invalidate an embargo set up to allow time to find a fix for the flaws. 

While he disputed that his actions would have caused problems for other defenders, Lorenc conceded that the evidential threshold in these coordinated cyber defense systems is a “grey area.” 

The revelation of the PHP flaw brings out into the open what cyber officials have been bracing for since the arrival of the most powerful tools of artificial intelligence, which not only can be used to discover vulnerabilities but also to exploit them at scale. 

The cybersecurity world’s long-established protocols helped prevent disaster scenarios, in which hackers would have successfully exploited the vulnerabilities to take control of numerous websites and access their data. But now the scale and end-of-days potential of AI-driven cyber risks are visible for the world to see. 

This “is what happens when AI turns up a flaw that’s been hiding for years,” said Eylam Milner, co-founder and chief technology officer at cybersecurity start-up Echo. The vulnerabilities, he added, are “about as serious as it gets for the web.”

Origin story

Understanding how this week’s emergency unfolded offers a glimpse at how companies and authorities are working to stave off attacks — and how much risk they face going forward. 

The origins of the incident can be traced back as far as April when top frontier AI firm Anthropic unveiled Mythos, leading some in the cybersecurity world to worry that systems would quickly be overrun by advanced artificial intelligence, with potential for catastrophic events to ensue.

But while researchers did find more flaws in computer systems in the months after Anthropic and other AI firms like OpenAI released those models, they had little impact in the real world. Even the Hugging Face incident, a widely discussed hack that saw OpenAI’s autonomous AI agents go rogue during an internal security evaluation, related more to the level of control AI companies exert over their models than their power to break into systems worldwide. 

That changed this week after researchers unveiled the vulnerability in PHP, a coding language estimated to be integrated into some 70% of the web.

The process by which information about flaws is released among cybersecurity officials and affiliated companies is crucial. Through a longstanding practice known as coordinated disclosure, researchers and companies that identify flaws can find a fix and share it confidentially with agencies and others before releasing to the public, meaning they don’t hand malicious hackers the gift of a hole without a fix.

In the case of the PHP flaw, that process worked well, but not perfectly. Information about the bugs started to circulate ahead of the planned release time. Then, according to the PHP Foundation, Chainguard “unilaterally broke the embargo,” which “disregarded weeks of work by many parties toward a coordinated disclosure.” PHP Foundation executive director Elizabeth Barron told POLITICO by email that while it was “disappointed” with Chainguard, it hopes to “rebuild trust with them in the future to ensure we can continue to collaborate effectively.”

After the leak— which meant information about the bugs was in the open before the fix was ready — confusion quickly ensued, with government bodies and private companies choosing to temporarily shut down their websites rather than risk potentially damaging breaches to their data and the sites themselves.

Early Thursday, Matthew Prince, the CEO of Cloudflare, an internet services company that is widely used by websites to block cyberattacks, giving it a high level of visibility over what hackers are doing, said in a post on X that it had seen “millions” of attempts to exploit the flaw.

Cloudflare saw thousands in the 10 hours before the flaw was publicly announced, then tens of thousands in the 45 minutes after the announcement, hundreds of thousands within two hours, and now millions, Prince said.

Amazon’s cloud division also said the flaw is “now being broadly exploited in the wild.”

One senior U.S. government cyber official said that federal authorities have been overwhelmed — and not just by PHP. The same day the world was racing to address PHP, they were also dealing with bugs in node.js, a widely used JavaScript framework, Fortinet, GitHub and Oracle.

“The fire department is fighting multiple fires at once,” the official said, adding: “The good news is they’re all one-story structures on fire, which the fire department deals with all day, every day.”

More to come

Dauntingly, OpenAI said there’s more on the way. “These bugs are among several significant vulnerabilities we’ve already found and are working to fix, and we expect similar findings to increase sharply in the coming months,” the company said Wednesday in a statement.

Matthijs van Amelsfort, head of the Dutch cybersecurity agency, said in an interview that the job of keeping computer systems safe has been transformed by the advancement of AI. “As soon as the frontier models came out, that’s exactly what we said, this will be the trend,” he said. “And actually that’s happening now.”

Thomas Caspers, vice president of Germany’s cyber agency BSI, concurred: “We expect that [to be] happening more and more during the coming months.” 

AI also ramps up the risks once the flaws are out in the open. Cyber agencies’ recommendation that organizations take their websites offline was “really a drastic measure,” Caspers said. “We wouldn’t have done that a few years ago or so.” But because AI has made it quicker and easier to exploit flaws, “we had to do that,” he said. 

At the same time, the use of advanced AI to detect the flaws may create a new level of protection against malicious hackers looking to take advantage of them. Caspers said that though his German agency has also seen attacks, it has not seen any successful use of the flaw by hackers.

“It seems a little bit more complicated than expected to exploit,” he said. 

Despite the fact that AI offers a new way to discover flaws, the work involved in keeping systems protected is more quotidian, with cyber agencies urging organizations to install the fix shared by the PHP Foundation, in a process known as patching.

“There are three things that you have to do right now,” said van Amelsfort from the Dutch agency. “And that’s patch, patch, and patch.” 

John Sakellariadis contributed to this report.

Jamie Dettmer is associate editor and a foreign affairs columnist for POLITICO.

The war in Gaza hasn’t figured much in campaigning for Israel’s upcoming election — despite the likelihood that Israel’s Arab minority, Palestinian by heritage, might well decide who gets to be prime minister. 

Israel’s Arabs make up around 20% of the electorate that will be casting ballots in the Oct. 27 parliamentary election. And thanks to complex coalition math, Arab parties might well be the ones to crown Prime Minister Benjamin Netanyahu’s main rival, former military chief Gadi Eisenkot, who leads a center-right opposition bloc.

But campaigns by both the Arab parties and Jewish politicians have avoided talking about what the outcome might actually mean for Jewish-Arab relations in the region, for the possibility of a two-state solution and even for U.S. President Donald Trump’s vision for a comprehensive peace-through-prosperity deal between Israelis and the Palestinians.

“The election campaign has been bizarre,” said Michael Milshtein, a retired Israeli army colonel and former head of Palestinian affairs in Israel’s military intelligence agency. “The campaign has been focused on domestic and personal issues, and on Netanyahu.” 

That means it hasn’t included “the very deep complicated issue of the critical relations between us and the Palestinians, and what kind of scenarios or solutions are left after the Oct. 7 Hamas attack and the Gaza War — for any kind of political settlement,” Milshtein said.

But outside of Israel there’s alarm — especially among Arab leaders — over the absence of any serious debate about how to end the multi-front conflicts Israel is engaged in and what that might foretell, said HA Hellyer, a geopolitical scholar specializing in the region. 

“Netanyahu, or not, the Israelis are on a particular trajectory when it comes to foreign and security policies,”Hellyer told POLITICO. 

“Opposition politicians blame Netanyahu for Israel’s increasing diplomatic isolation and loss of support in parts of Europe and North America. But when you look at what they’re actually saying, they’re not arguing with the policies when it comes to Gaza. They support the overall settlement project in the West Bank. They support the incursion in Southern Lebanon. Their proposition is that they could have done things in a better way,” said Hellyer, who’s a fellow at Britain’s Royal United Services Institute. 

Mentions of the Gaza conflict in election campaigns have been largely limited to clashes over who was to blame for failing to prevent the Hamas attack on southern Israel, which killed more than 1,200 people.The Eisenkot-led Change bloc has focused on Netanyahu’s role in the lead-up to the Oct. 7, 2023 massacre, pointing to the failures of his government and arguing he ignored warnings of a likely big Hamas attack. But the bloc has done little to flesh out its governing policy platform.

Meanwhile, Netanyahu’s campaign has sought to frame Eisenkot as an appeaser and puppet of Arab party leaders — such as Mansour Abbas, leader of the Islamist Ra’am party, and Ahmad Tibi, leader of Ta’al party — arguing he would compromise on core security issues to persuade them to join or vote with his coalition bloc after the election to give him a Knesset majority.

“The lack of real content is a major problem for such a crucial election,” the Jerusalem Post lamented in an editorial this week.

Few see any chance of a negotiated peace or a two-state solution any time soon. Israelis largely view international condemnation as biased, and say critics of Israel’s conduct in Gaza fail to understand what the country has to do to survive. 

But at some stage or another, Israelis will have to have conversations about peace, and delaying them isn’t going to help the country reduce its deepening isolation or help repair strained ties with traditional allies, including Europeans, who are starting to impose sanctions and considering arms embargoes. 

Former Israeli Prime Minister Ehud Olmert, a fierce Netanyahu critic, said that while there has been election debate about how successful the Gaza war has been in degrading Hamas, “it’s true that the main issue of our future with the Palestinians has been ignored.” He added: “Had I been running, I would have talked about it the whole time.”

So why hasn’t peace been on the agenda?

As Olmert sees it, the root lies in “the huge trauma of Oct. 7, along with the perception that public opinion, the mainstream, has shifted from where it was before the massacre and moved further rightward politically.” That isn’t uncommon: When Israel suffers a severe psychological blow, the political center-of-gravity habitually moves sharply to the right, favoring hawkish and nationalist positions and marginalizing more conciliatory perspectives.

Olmert isn’t entirely convinced that perception is completely accurate this time,  pointing out that Netanyahu’s ruling Likud party is likely to lose a significant number of its Knesset seats — from its current tally of 32 to around 20 — after next week’s elections. 

“Nonetheless, the perception is that general public opinion has shifted and, therefore, all of the other parties are hesitant to talk about any political process with the Palestinians or about negotiations or about a two-state solution, and so on and so forth, because they worry they’ll lose support,” Olmert said.

Polls show an overwhelming majority of Jewish-Israeli backing for military action. When it comes to the conflict with Iran, Israel Democracy Institute surveys have recorded support levels as high as 93% for the initial strikes, and nearly 80% back the continuation of the war. There has also been overwhelming Jewish-Israeli support for sustaining military pressure on Hezbollah in Lebanon and for multi-front security strategies.

Sven Burgsdorff, a former EU representative and ambassador to the West Bank, doesn’t subscribe to Olmert’s view, instead arguing there’s not much difference between Netanyahu and the leaders of the center-right Change bloc when it comes to Gaza or a two-state solution — something Netanyahu dismisses out of hand regularly, saying that Palestinian sovereignty is incompatible with Israel’s security.

“Even if the right-wing Netanyahu coalition were to be replaced by the current opposition, none of its main leaders — Eisenkot, Naftali Bennett, Yair Lapid and Avigdor Lieberman — question the IDF’s conduct [in] the war on Gaza, nor are they supportive of the idea of Palestinian self-determination. Only Yair Golan of the Democrats and the coalition of Arab parties are in favor of that,” he said in an interview.

Opposition leaders don’t criticize Netanyahu for the conduct of the Gaza war, Burgsdorff continued. Their issue with him is whether he was at fault for not protecting Israel from the 2023 attack. They also accuse him of being set on dismantling Israel’s democratic system and for having no exit strategy for his forays into broader regional conflicts. 

Netanyahu has made a long political career out of leveraging external crises to keep his grip on power. And even now, it would take a brave commentator to write him off and suggest that Bibi the Magician, to use one of his nicknames, has lost the magic touch. The Israeli leader has pulled off stunning turnarounds in his long political career, including in the 1990s when he beat Shimon Peres in elections held just months after the assassination of then-Prime Minister Yitzhak Rabin.

Olmert still hopes for a Netanyahu defeat and says if Eisenkot is installed, he might make conciliatory moves like meeting with Mahmoud Abbas, the president of Palestinian National Authority. 

“He won’t be able to do anything big or quickly with Bennett and Lieberman in his cabinet. Both of them are completely opposed to the idea of Palestinian sovereignty. They keep saying it all the time. ‘There will never be a Palestinian state,’” he said. “So the political space will be very limited.”

But without some serious movement toward a two-state solution, Israel could risk alienating more of its traditional allies in Europe and the U.S.

This story appeared in Today, Explained, a daily newsletter that helps you understand the most compelling news and stories of the day. Subscribe here.

Are we living through “Black October”? Maybe, according to cybersecurity experts who are raising the alarm about AI’s increasingly sophisticated and far-reaching hacking abilities. 

This week alone has seen a string of alarming incidents where AI uncovered previously unknown security flaws deep in the infrastructure of the internet. The most concerning involves something called PHP —  a programming language that, according to The Atlantic, is used by “as much as 70 percent of websites.” Cybersecurity researchers used AI to locate a major security breach in the technology.

It’s the kind of thing that, when it’s working, is practically invisible. When it stops, though, you really notice it: Government websites in the UK and Europe briefly went down earlier this week after the PHP vulnerability was discovered, as did some sites in the Wikipedia family, the Internet Archive, and many others.

The outages weren’t actually the result of a hack, but rather preventative action as web engineers took sites down to fix the vulnerability before it was exploited. But not every PHP-like issue will necessarily be uncovered before it can be exploited by someone using AI tools less ethically, and older websites relying on PHP might go unpatched. 

The problem doesn’t stop there, either: Concern is also rising around AI cybersecurity risks to ubiquitous conveniences like online banking. As Axios reported on Thursday, banks are detecting more and more “unauthorized third-party AI agents” operating inside of their systems. 

Those agents are mostly unauthorized by the banks, Axios explains — the holders of the bank account might have given them permission — but it still creates a security risk that executives described as “horrifying,” in part because banks can’t necessarily tell if an agent doesn’t have permission. 

It’s a lot to take in, all of it moving extremely quickly, and it’s hard to tell what any of us can do about it as AI labs continue to forge ahead with ever more competent AI models and agents. Luckily, my colleague Adam Clark Estes has some simple recommendations to shore up your own cybersecurity.

How do I respond right now?

One problem with hackers — even those that happen to be AI agents — is that they can be unpredictable. You won’t know to, say, lock down your Quest Diagnostics records before a breach happens. But whenever you find yourself wondering if your data is safe, that’s a good time to double check that you’ve at least covered your bases.

The National Cybersecurity Alliance, a nonprofit dedicated to the safe use of technology, maintains a list of basic online safety practices that everyone should follow. In no particular order, here’s what to pay attention to now:

1. Keep your guard up. AI makes it difficult to know the difference between humans and robots. It’s a fact of life in the year 2026. So be extra careful to avoid engaging in potential phishing scams. Don’t reply to unknown texts, and do due diligence on texts or emails that look like they’re from people you know but just seem off. Don’t click weird links. Don’t give out personal info over the phone, even if it sounds like it’s someone you know. They might be scammers using AI to clone a loved one’s voice.
2. Update your software. Yes, it’s annoying to pause your phone or computer use for a few minutes to update your software, but this is one of the best ways to get rid of vulnerabilities. Companies like Apple and Google employ huge teams of security experts to spot these in their software and fix them with software updates. Do the updates.
3. Use a password manager or, even better, passkeys. Each of your online accounts should have a unique password that’s at least 16 characters. Yes, it’s impossible to remember that many passwords, so you should also use a password manager like 1Password or the app built into your iPhone or Android device.
4. Turn on multifactor authentication. Just in case you don’t already do it, make sure you use multifactor or two-step authentication for all your accounts, including email and social media. It can be annoying to type in a code or check your email while logging in, but hackers, including AI agents, will have a much harder time getting into your accounts if you take this step.

Taking all these measures is not a one-time affair. You have to be vigilant in keeping yourself safe online. Security experts have a term for this that’s almost too specific: cyber hygiene. Like brushing your teeth or taking a shower, take good care of your online life, and do it often.

One link for later

➨ Is it still possible to ban gerrymandering? The current US Supreme Court is very, very hostile to getting politics out of congressional map-making. But if Democrats win back power, that doesn’t mean they shouldn’t try. My colleague Ian Millhiser gamed out how they could do it in a way that survives the Court — as well as some approaches that almost certainly wouldn’t fly. But, he writes, the real trick will be finding a solution that functions the way Congress wants it to and can’t be exploited by mapmakers.

Before you go…

• Did you know…that the disease multiple sclerosis is misdiagnosed with surprising frequency? As many as 15 percent of diagnoses could be false positives — including that of Christina Applegate, who found out this week that she does not have MS despite a 2021 diagnosis.
• Today’s trivia: Which noble gas is radioactive and has the chemical symbol Rn? (You can find this and other brain puzzles in Vox’s daily crossword. Look for the answer in Monday’s edition.)
• Yesterday’s trivia: We asked what the plural was for multiple Toyota hybrids. That would be Prii, which Toyota officially confirmed in 2011 after holding a vote.

Remember Popcorn Time, the app that served as an easy-to-use front end for streaming torrents of movies and TV shows? Development of the MPAA's least-favorite app of the 2010s has been abandoned for years, but the "Netflix of Piracy" software is still installed on millions of devices that are just waiting to join a bot army. Researchers at Eye Security found the updater for a Popcorn Time fork called "Time4Popcorn" still running on tons of Windows, macOS, and Android devices located around the world, phoning home to now-abandoned web domains over unencrypted HTTP and running an outdated, insecure version of Chrome.

Eye Security's Niels Teus …

Read the full story at The Verge.

Quest is the latest in a series of healthcare technology companies that have been hacked in recent months.

A drone has hit a commercial ship off the coast of Romania, killing at least one crew member with three more still missing, Romanian President Nicușor Dan said Friday. 

“This morning we experienced a security incident: A vessel was struck by a drone approximately 13 nautical miles from the coast, just beyond Romania’s territorial waters,” Dan said, praising the coast guard for saving nine sailors as part of the rescue operation. “Unfortunately, one sailor has died and three others are still being searched for,” he added.

The Khoryv ship, flying under the flag of Comoros, suffered significant damage, capsized and partially sank, according to Romania’s Interior Ministry.

The incident is the latest in a string of drone attacks on commercial shipping in the Black Sea. Dan told POLITICO last week that Russia’s intention was clearly to weaken Romania’s support for Ukraine in the war but vowed not to back down. 

NATO allies met Tuesday to discuss the threat to Black Sea shipping and Dan said Romania would receive “additional capabilities” to help defend the area. 

“Evidently, this is an incident within the broader process of escalation that Russia is pursuing in the context of its war in Ukraine,” the Romanian president said.

European Commission President Ursula von der Leyen said she was “deeply alarmed” by “yet another Russian escalation in the Black Sea.” The ship was carrying Ukrainian and Azerbaijani crew, she said.

“These reckless attacks target innocent lives and openly defy international law. My thoughts are with the family and loved ones of the sailor that was killed. And with the families of the three crew members still missing.”

Over the last month, drones have hit several cargo ships and chemical tankers close to Romania and Bulgaria — both NATO members — killing more than 20 people in total.

Reuters reported that the ships hit by drones in recent weeks had been near or heading towards the Sulina Canal, linking the Danube River and the Black Sea. This has become a key export route for Ukrainian grain and food oil after Russia attacked Ukraine’s own Black Sea ports.

This article was updated.

THE HAGUE — The European Commission should act “as soon as possible” to give clear guidance on U.S. sanctions against the International Criminal Court, its top administrative official told POLITICO in an interview.

Osvaldo Zavala Giler, who oversees the day-to-day functioning of the Hague-based court as the institution’s registrar, said his job became “preparing for sanctions” as the White House imposed an escalating regime of restrictions against it.

The Trump administration targeted prosecutors and judges from the court first in February 2025 before announcing blanket sanctions on Oct. 9 this year. The EU has repeatedly backed the Court against Washington, but it has resisted calls to activate a mechanism that would forbid firms from complying with U.S. laws.

That has agonized senior figures in The Hague. Zavala Giler said the Commission’s “lack of clarity” left private companies and NGOs in the dark over whether they should comply with sanctions decided by Washington — and what risks they face if they don’t.

Zavala Giler’s call to the Commission adds to pressure from EU lawmakers for a swift response after the Oct. 9 announcement. Kallas told the European Parliament on Tuesday that Brussels would use the next few months “to open dialogue” on the issue. The new sanctions are set to take effect in April next year.

“What I would hope is that the space for dialogue is not interpreted as a space for waiting to protect the court,” Zavala Giler said, who spoke from his glass office on the eve of a visit to the Court’s headquarters by the EU’s top diplomat, Kaja Kallas.

Damocles sword

Anticipating sweeping sanctions, the Court spent six months abandoning U.S. tech providers and moving to an open-source software environment, and 20 months to make its financial transactions dollar-proof. That move has been a huge undertaking for Zavala Giler’s team, he said.

The Court initially deepened its reliance on U.S. technology after it was hit by a massive cyber attack in 2023, but what seemed a solution at that time became a problem in the face of sanctions. Even though the current regime includes a carveout for telecommunications, there is no guarantee it will remain the case.

“It becomes a sort of Damocles sword on top of our head that could be revoked at any time,” Zavala Giler said. “I cannot count on U.S. tech companies anymore.”

U.S. platforms operate as entire ecosystems, offering all-encompassing solutions under a single contract. To do without them, “you need to start creating your own architecture and systems that need to speak to each other,” the registrar said.

Financial autonomy was equally hard to achieve. The Court mapped all its suppliers’ transactions to ensure there was no U.S. nexus, meaning that no U.S. person, bank or currency is involved in a payment. “We made all of our staff members have European bank accounts. It was a very detailed process that we had to do, person by person, company by company, making sure that the contracts were in euros,” the registrar said.

The Court also went from working with tens of banks to only “a few,” since only a handful of institutions are comfortable with dollar-proof payments.

Chilling effect

That situation is likely to worsen without clear guidance from EU countries and the Commission. As Zavala Giler put it, “if the International Criminal Court cannot transact in Europe, in euros within the SEPA zone with no U.S. nexus, then there is a bigger question about European financial sovereignty.”

The Court has long called the EU to use a legislative shield — known as blocking statute — that would forbid EU firms from complying with U.S. sanctions. The request was backed by dozens of lawmakers at the European Parliament, which incidentally awarded the court its human rights Sakharov Prize on Thursday.

The blocking statute “becomes an instrument to reassert the minimum space that should not be affected by unilateral extraterritorial sanctions … that minimum space should be, at the very least, the eurozone,” Zavala Giler said. Even without it, the court needs “the reassurances that, at least within the eurozone, [it] can continue to operate,” he added.

So far, however, the Commission has taken a cautious approach, choosing dialogue with the U.S. as a way of “buying time,” as a EU diplomat put it to POLITICO.

In a balancing act, EU heads of state and government backed Brussels’ diplomatic effort at their summit last week, while also committing to do whatever is needed to support the Court.

“I hope that now that the European Council has opened this door, the Commission will feel more comfortable in taking an extra step. And at the very least, providing some kind of clear guidance,” Zavala Giler said.

As an intermediate step, the registrar suggested the use of “comfort letters” reassuring firms that they should not comply with the U.S. measures.

Zavala Giler stressed that sanctions were not only a matter to address for banks and tech operators, as the current uncertainty has already affected NGOs working with the Court. NGOs play a critical role in supporting the work of the Court, for instance “to provide reparations for victims in Uganda” or “to assist the work of the court in providing assistance to victims in Ukraine.”

“This has created an enormous chilling effect,” he said. “They don’t know if they have the legal protections or not, to continue supporting the work of the court.”

The registrar’s office overlooks the moat circling the court’s six towers across the compound’s 46,000 square meters. In one of these buildings, the trial of former Philippine President Rodrigo Duterte over alleged crimes against humanity is due to begin next month. Reporters who will cover the proceeds won’t be allowed to use their phones — only paper and pen.

It is Zavala Giler’s job to oversee this huge institution, which relies on secure communications, cross-border funding for investigations and the contribution of many NGOs.

“This court has for victims the promise of the never again,” Zavala Giler said.

ROME — Roadblocks by truckers in southern Italy are exposing the limits of Prime Minister Giorgia Meloni’s hardline approach toward protests, as she concedes she will have to take a carrot-and-stick approach to demonstrators struggling with soaring fuel costs.

The demonstrations across the south are fast spiraling into a full-blown economic crisis. Truck drivers and farmers protesting soaring diesel bills have blocked highways, ports and distribution centers this week, leaving supermarket shelves empty and petrol pumps dry. Airports in the south are also suffering from fuel shortages.

After a cabinet meeting on Thursday, the right-wing Meloni vowed to use a security decree to clear the roadblocks, but also pledged to give financial relief to farmers and fishermen crippled by the price of diesel.

Regarding the decree, she said her government would not be “blackmailed by those who use violence as an instrument of pressure.” But she cushioned that blow by acknowledging that financial relief measures were needed to offer “immediate responses, especially to workers, to people who are in difficulty, to families.”

With elections expected in spring next year, the truckers’ protests threaten to shift the political debate from immigration and crime to whether Italians can afford to keep their businesses running. 

Gaetano Amato, a lawmaker from Naples for the populist left 5Star Movement, accused the government of offering security measures instead of answers to the economic grievances driving the protests.

“The government has done nothing and is continuing to do nothing, because it is basing everything on security decrees,” he told POLITICO. 

Stefano Orlacchio, president of the opposition center-left Democratic Party’s youth wing in the southern region of Campania, also slammed the government’s response as “an anti-southern attitude.”

“The protests in the south aren’t being taken into consideration at all,” he told POLITICO.

Diesel squeeze

At the heart of the revolt is a squeeze that truckers say they can no longer absorb. Diesel prices in Italy have risen by about a third since the U.S. and Israeli strikes on Iran began, and the cost of a long haul journey like Naples to Milan has climbed with them. 

Pasquale, a truck driver with a Campania-based company, who asked POLITICO to withhold his surname for fear of retaliation, said a trip’s profit had now shrunk sharply once fuel, tolls and wages were covered, and that the extra cost was working its way down the supply chain to supermarket shelves. 

Far-right Transport Minister Matteo Salvini of the League party, who posed in a truck cab a few months ago, should “come spend a week with me and we’ll see how comfortable it is,” Pasquale quipped.

While a cap on fuel prices exists on paper, he added petrol stations had ignored it “in these days of chaos.”

Beyond fuel prices, Pasquale zeroed in on EU environmental rules that Italian businesses struggle to comply with, even as cheaper foreign produce continues to reach supermarket shelves. “How can you face something like that?” he asked.

The Brussels-based International Road Transport Union has also appealed directly to European Commission President Ursula von der Leyen for help. 

In a letter sent on Thursday and seen by POLITICO, the group and its national member associations said they did not support the blockades but warned that soaring diesel prices were pushing operators to the brink, calling for extended EU state aid and tougher rules on late payments from customers.

The blockades hit hundreds of supermarkets and dozens of distribution centers, according to retailers’ association Federdistribuzione. Fresh fruit, meat and fish ran out within days, followed by other food products, leaving some shops completely empty.

Carlo Alberto Buttarelli, the association’s president, put the damage at “tens of millions of euros,” with fresh food spoiling in trucks and warehouses. Supplies were beginning to resume in Sicily and Calabria on Thursday, but disruption remained in Campania. 

No room to maneuver

Meloni has limited resources to offer relief. Italy remains subject to EU deficit proceedings, constraining Rome’s room for additional spending, while the international instability driving fuel prices higher lies largely beyond her control.

Amato dismissed the announced support from the cabinet meeting on Thursday as money that had already been promised.

While the government’s reaction to last weekend’s northern protests, which were hijacked by masked gangs that looted shops and set fires, was to link the unrest to immigration and deploy troops, the southern unrest is harder for Meloni to handle because it demands concrete economic relief, said Marco Valbruzzi, a researcher at the University of Naples Federico II.

Frustrated voters could turn to the 5Star Movement, which has previously channeled economic discontent in the south, or abstain from voting altogether. 

The protests could also weaken the appeal of early elections expected in April or May next year. A winter of sustained protests would give Meloni a reason to wait until autumn 2027, hoping for an ease in international instability and improved fiscal flexibility. 

If economic grievances dominate the campaign, “she is playing an electoral game on a field that she cannot control,” Valbruzzi said.

Microsoft points the blame for ConnectWise's breach at a China-aligned hacker, which relied on AI agents to rapidly hack into thousands of its customers.

he world is starting to understand that there is no way to fully and lastingly protect itself from President Donald Trump.

The man just can’t let things go — and he’ll get creative to get what he wants.

The latest blowup over Ukraine is emblematic of Trump’s wily persistence, and it suggests a challenging two years lie ahead for the international set even if Democrats gain some power in the midterm elections.

Not that long ago, Trump seemed to have patched up ties with Ukrainian President Volodymyr Zelenskyy as Kyiv made gains against Russia. Trump signed legislation last month that was championed by his late friend, Sen. Lindsey Graham (R-S.C.), to impose heavy new sanctions and tariffs to punish Russia for its war on Ukraine.

This month, the original Trump — the one who fawns over Russian leader Vladimir Putin and despises Zelenskyy — roared back. He waived many of the legislation’s penalties on Russia, moved to buy Russian diesel and signaled he’s more interested in doing business with Moscow than seeking justice for Kyiv. Ukrainians suspect the U.S. has pressured them by throttling its satellite connections and intelligence-sharing. (The Trump administration disputes much of this.)

“Russia, frankly, has been fine on Ukraine,” Trump said Monday as he welcomed the idea of an arms control summit with Putin and Chinese leader Xi Jinping that might include talks about Ukraine.

The lesson, foreign officials and others steeped in diplomacy tell me, is that you cannot truly change Trump’s mind or stop his overall trajectory. Even if Trump seems briefly chastened or stages a tactical retreat, he will eventually return in new, often-surprising modes to push his original views and goals. He will try to exhaust you into submission.

Imagine how startling it is to be Ukrainian these days as Trump pressures you to make concessions to Russia by blaming you for a global energy crisis he caused by launching a war on Iran. Or what it’s like for officials across European capitals trying to craft a response, knowing there’s never an end to the process.

“There is no immunity to Donald Trump. He makes a deal in order to make a better deal the next day,” one senior European official mused, having been granted anonymity because the topic involves sensitive diplomacy.

It’s hard to blame world leaders who think they’ve learned to manage Trump only to be bewildered by a sudden left hook on his part. Foreign policy is often driven by hope when you lack good options. And Trumpology is a confounding, but still a relatively new, subfield.

Besides, Trump’s messaging is inconsistent, incoherent and nonstrategic — characteristics that can obscure his single-minded pursuit of his goals. So the global actors dealing with him — whether it’s the Gulf Arab states who shower him with gifts or the Canadians furious over his trade and territorial threats — sometimes think they’ve come to terms with him only to find they’re fighting on a newly configured plane.

A Supreme Court ruling that gutted many of Trump’s tariffs earlier this year was good news in many capitals. But since then, the so-called Tariff Man has moved to impose the import taxes under pretexts not considered by the court, including turning to accusations involving forced labor.

The White House doesn’t dispute Trump’s aggressive tactics.

“There is no greater fighter for America First interests than President Trump — and he is willing to look anyone in the eye to deliver wins on behalf of the United States,” spokesperson Anna Kelly told me in a statement.

The Greenland saga shows the limits of trying to mollify Trump.

In his first term, Trump wanted to buy the frozen island. The idea was shelved amid global laughter, but authorities in Greenland and Denmark made it clear to Trump that they welcomed more U.S. investment in the Danish territory.

In his second term, Trump huffed and puffed about an all-out U.S. takeover of Greenland, only to agree in September to an expanded U.S. military footprint that he could have gotten anyway under existing, decades-old diplomatic accords without all the drama. The whole affair has led to lingering anger in Europe about what Canada’s leader called a “rupture” in the global order — but many European officials hoped that the saga had faded away.

Yet, it’s far from certain that Trump has given up on possessing Greenland. Just days ago, he touted on social media plans to start oil, gas and mineral exploration in “our new and beautiful Greenland.”

The use of “our” is more than a little suggestive.

Defying Trump, too, can get you only so far.

Brazilians effectively told Trump to take a hike when he used tariffs and sanctions to punish the country for charging its former president, Jair Bolsonaro, in a coup attempt.

A few months later, as Bolsonaro was about to start his prison sentence, Trump seemed to admit defeat in his effort to help his political ally. “That’s too bad,” he said in November 2025, with little emotion. (“Brazil Defied Trump and Won,” The New York Times declared.)

But Trump wasn’t done with Brazil. He and his team have pursued efforts to undercut the current Brazilian government while quietly backing Bolsonaro’s son, Flávio, in his efforts to win the presidency this year. The runoff election is on Sunday, and it’s tight.

World leaders are doing what they can to make their countries Trump-resistant, if not all-out Trump-proof.

That has meant everything from diversifying their sources of trade and security alliances to joining Trump on ventures that, on the surface at least, can be helpful to them. (Then there are the many countries, especially in Africa, that diplomats privately tell me are happy to be off Trump’s radar.)

My takeaway from watching all of this, though, is that it’s not enough to stay one step ahead of Trump. You have to stay several steps ahead, and you have to be wildly imaginative about the lengths to which Trump and his devoted aides are willing to go to complicate your life.

The second Trump administration is filled with people who have turned to unique, bizarre and clever interpretations of law and reality to push his agenda. It’s not always clear who is behind which move, but it’s hard to imagine Trump isn’t fine with most of what’s happening.

It’s why a teenager is being held in immigration detention for the actions of his grandmother decades ago. It’s why Congress can scream and shout about its spending orders yet Trump ignores it.

Sen. Chris Murphy (D-Conn.) said other nations should not hope that the Republican Party will shed Trump’s worldview, including his disdain for allies, once Trump’s out of power.

“I would love for our allies to know that we have consistent common adversaries that we’re going to work together to fight. I just don’t know that you can make that guarantee,” Murphy, a frequent Trump critic, told me. “That’s painful to say, but given the state of the Republican Party right now, it’s true.”

I understand why Ukraine and the European Union are trying to diversify their sources of intelligence and military industrial bases as Trump keeps chasing love from Russia.

Despite Secretary of State Marco Rubio’s claims, the reality is that the United States can no longer be trusted for such security assistance.

But it’s not enough to find new intelligence partners or weapons manufacturers. You have to ask bigger questions, like, “What are the untapped streams of intelligence that no one knows are out there? What’s a potential weapon no one has considered? How can I acquire what I need before Trump stops me?”

Governments need to have plans — now — for scenarios that seem completely crazy. Better to be wrong than unprepared.

Still, even if you do all of that … “I don’t think it’s possible to stay two or three steps ahead of Trump,” said Charles Kupchan, a former senior national security official during the Obama administration who apparently enjoys raining on parades.

“He acts on impulse,” argued Kupchan, who has a new book out on the crumbling world order. “We need to try to limit the damage he’s causing and ride him out.”

A Democratic win in November’s midterms — one or both chambers of Congress — is unlikely to do much to rein in Trump’s actions abroad during his final years, current and former U.S. and foreign officials tell me.

He still has the veto and has been willing to ignore congressional demands. There’s also the fact that presidents have significantly more power to act in unilateral ways overseas than they do domestically.

Ukraine, the European Union, the world — all will be dealing with a politically wounded Trump who’s likely to double down on what he feels he must have.

“He’s going to be angrier,” Murphy predicted.

Two vulnerabilities found in the programming language PHP put enormous swaths of the internet in danger.

By some accounts, up to 70 percent of websites use PHP in some capacity. It powers Wikipedia, WordPress, Drupal, and a host of other popular sites and platforms, including DeviantArt and 4Chan, which were temporarily shut down after the vulnerabilities were disclosed. Even governments weren’t immune.

But it’s not as simple as updating a few servers. The vulnerability exists in every version of PHP dating back roughly 20 years, many of which are no longer supported. That means some older sites and services that are no longer actively maintained are at risk, leaving them with little option but to permanently shut down.

Here’s all the latest developments in what security firm Wiz has called “among the most severe vulnerabilities discovered … in software history.”

• Two old-school Japanese mobile games are shutting down over the PHP exploit.
• The PHP2Shell exploit hit Cloudflare hard.
• PHP: The three letters that shut down sites all over the internet today
• GPT‑5.6 Sol was used to identify critical PHP flaw.
• A critical PHP vulnerability may take websites down today

The vibe-coding platform said all of its customers should revoke and rotate their private keys, after hackers were able to decrypt some customer secrets.

PARIS — French President Emmanuel Macron has instructed local authorities to ban protests on Saturday except those organized by unions, he said Thursday.

Any request to “protest” or “regroup” made by people “who have no legitimacy to do so” will be “refused,” Macron said after a security meeting with Prime Minister Sébastien Lecornu and intelligence services.

The aim, he added, is to maintain public order and “protect businesses” after last week’s turmoil in France.

Hundreds of thousands of demonstrators took to the streets, while incidents of vandalism and looting affected thousands of businesses and public buildings on the sidelines of the protests.

Calls for a fresh round of protests have already begun to emerge online, raising the possibility of a protest movement that becomes a weekly occurrence, as was the case during the 2018-2019 Yellow Vest movement.

“The president believes that six months before a presidential election, debate should take place more in TV studios, in newspapers, and ultimately by the choice at the ballot box,” a person close to the French president said.

Trade unions usually hold talks with local authorities ahead of planned demonstrations. For Saturday, authorities may offer “alternative routes” to ensure maximum security, Macron announced.

He added that he will chair a defense council Friday and announce “new decisions” afterward.

Interior Minister Laurent Nuñez said elite tactical police units and a military unit normally deployed on French soil for counterterrorism operations would also be mobilized this weekend.

The government has been accused of mismanaging last week’s protests by significantly underestimating the number of demonstrators and consequently failing to deploy enough police to prevent criminal acts on the sidelines.

A protest organized by a major trade union Saturday in Paris has been approved, French media reported, while all protests in the area including Lyon, one of the country’s biggest cities, have been banned.

LONDON — Brussels is proposing to extend negotiations on its core demand for cut-price tuition fees for EU students studying in the U.K. beyond next month’s leaders’ summit, as a package of deals nears completion, three EU diplomats with knowledge of the talks told POLITICO.

The European Commission on Wednesday presented the option to member countries of decoupling the tuition fee demand from the long-delayed U.K.-EU summit on Nov. 20.

A postponement would clear the way for a deal to be struck on other key elements of Britain’s “reset” with the bloc, including new agreements on agri-food trade, emissions trading, and a youth experience scheme.

The diplomats — all of whom were granted anonymity to speak freely about ongoing talks — said the proposal would involve asking the U.K. to commit to finalizing an agreement on tuition fees within six months. The proposal was first reported by the Financial Times.

The EU is pushing for European students to pay the domestic rate for tuition fees when studying at British universities, as they did before Brexit.

But one of the diplomats highlighted that the tuition fee demand was still part of a wider “package” linked to the other three agreements slated for the summit, and that the agreements would not enter into force until there was agreement on all areas. 

In addition, the diplomats confirmed that both sides were considering a joint summit statement on economic security, amid mounting U.K. concerns about the EU’s Made in Europe proposals.

Meanwhile, negotiations on a sanitary and phytosanitary (SPS) deal — which would see the U.K. and EU align on agri-food standards — are close to completion, two of the diplomats said. The deal would include temporary arrangements for gene-edited plants and novel foods, such as lab-grown meat.

For gene-edited plants, the U.K. wants to keep its own rules until equivalent EU rules come into force, and has pledged not to change them in the meantime.

For novel foods, the U.K. would follow EU decisions to approve or reject products, but could set its own rules for products the EU has not yet assessed. In both cases, the products would be sold only in Great Britain and would not have access to the EU single market.

Dan Bloom contributed to this report

LONDON — Britain’s energy regulator is planning to authorize urgent investment to increase gas pipeline imports from continental Europe this winter, amid fears over the country’s ability to supply all customers in an emergency scenario. 

The plans, outlined in a document published Thursday morning, have been published a day after Energy Secretary Miatta Fahnbulleh approved a controversial North Sea gas project, Jackdaw.  

Government documents show that gas security considerations were given “substantial weight” in her decision. 

In a consultation paper, Ofgem said that, without intervention, Britain would have a “negative supply margin” this winter, in the event of a one in 20-year cold day — a day so cold Britain would only be expected to have one every 20 years — coinciding with the loss of key gas infrastructure. 

This unlikely scenario is a key standard followed by Britain’s energy authorities to assess its resilience in maintaining gas supply — also called the “N-1 gas security” standard. 

A shortfall in gas supply would be a national emergency, potentially requiring power plants or factories to shut down, or in extreme cases homes being disconnected from the gas network.  

Britain has never experienced a “network supply emergency,” but diminishing domestic supply and the threat of Russian sabotage of key undersea gas pipelines has raised fears over the country’s energy security. 

Last year the energy system operator, NESO, said long-term declines in domestic North Sea gas supply and global competition for LNG imports could mean the N-1 gas security standard is breached in winter 2030/31. 

However, there are now fears of a crunch point as soon as this winter, after the Belgian operator of the undersea gas pipeline Interconnector said it would cut planned export capacity to the U.K. because of soaring maintenance and operating costs. EU countries are also facing concerns over gas supply this winter. 

Ofgem, the regulator, said it is now planning to amend gas system operator National Gas’s regulatory licence, allowing them to cover the costs of maintaining imports from Belgium at current capacity, in agreement with Interconnector Ltd, majority-owned by Belgian firm Fluxys. 

“Without intervention, Great Britain could potentially face a negative supply margin in winter 2026/27 involving extremely high gas demand on a 1-in-20 cold weather day and the loss of the single largest element of GB gas infrastructure,” Ofgem said. “The position could become more constrained in future winters without intervention. While these are low-probability stress scenarios, their potential consequences are significant.” 

Costs will be recouped through customers’ energy bills. Ofgem said costs of £147 million could be passed on to bills, adding an estimated £1.19 to every domestic energy bill per year over a five-year period.  

Interconnector Ltd said it would restore British import capacity to 27.8GW this winter, an additional 11.3GW of capacity above the previously announced level. 

National Gas welcomed the plans but insisted that the warning over gas security “should not be interpreted as an indication that gas shortages are expected.” 

The Conservatives’ Shadow Energy Secretary Andew Bowie called the situation “utterly outrageous.” 

Britain is “going cap in hand to Europe and paying vast sums to import foreign gas,” he said, criticizing the Labour government for what he characterized as a failure to fully exploit domestic gas supplies. 

“Britain has one of the most secure and resilient energy systems in the world– and gas interconnectors form part of our diverse energy mix,” Energy Minister Michael Shanks said in a statement. 

“We are working with industry to build a gas system fit for the future, ensuring value for money for consumers while giving investors’ confidence to back Britain’s energy sector.” 

Cyberattackers have made “millions” of attempts to take advantage of a critical hole in a building block of the internet, a key cybersecurity provider said early Thursday.

Two top European cyber officials later told POLITICO that hackers have so far struggled to exploit the vulnerability.

Cybersecurity agencies worldwide continue to scramble to respond to the public revelation Wednesday of a flaw in PHP, a foundational computer programming language used to underpin 70% of the internet. 

Matthew Prince, the CEO of Cloudflare, an internet services company that is widely used by websites to block cyberattacks — giving it a high level of visibility over what hackers are doing — said in a post on X that it’s seen “millions” of “attempts to exploit” the flaw.

Cloudfare saw thousands in the 10 hours before the flaw was publicly announced, meaning information must have leaked, then tens of thousands in the 45 minutes after the announcement, hundreds of thousands within two hours, and now millions, Prince said.

Amazon’s cloud division also said the flaw is “now being broadly exploited in the wild.”

But Thomas Caspers, vice president of Germany’s cyber agency BSI, said in an interview that though his agency has also seen attacks, it has not seen any successful use of the flaw by hackers. 

“It seems a little bit more complicated than expected to exploit,” he said. “When we had the planning process before the release of the patch, we were expecting a much faster track of the attackers.” 

Caspers is not certain why this is the case at this stage, but said it appears that successfully making use of the flaws is harder than expected. Global cyber officials were part of a process coordinated by OpenAI, to find and fix the flaws. “An ad hoc exploitation seems a little more difficult than expected,” he said.

The challenge for bad actors may also be linked to the major AI providers building guardrails so their tools can’t be used to exploit flaws, he said. When a POLITICO reporter as a test asked ChatGPT and Claude, models from OpenAI and Anthropic respectively, how to exploit the PHP vulnerabilities, both chatbots declined to provide the information. The two companies did not immediately respond to requests for comment. 

Numerous European government departments took their websites offline as a precaution to Wednesday’s developments. As of Thursday morning, key French websites such as the justice ministry and the data protection authority still featured a message they were undergoing maintenance. 

Matthijs van Amelsfort, the head of the Dutch cybersecurity agency, told POLITICO that his agency has no indication that the flaw is “actively being misused” but said that can change, particularly because AI makes it easier to exploit flaws. The agency took its website offline on Wednesday, but it is now back up.

This article has been updated.

Eiliko, a cute robot charm you can hang on your bag with built-in AI conversations, turned out to be a security nightmare. It told owners that "your secrets are safe with me," but hackers could easily read complete transcripts of everything we told the toy, and that was just the beginning. The Verge and security researcher Sammy Azdoufal spent over a month trying to get in contact with the company, including emails to Energize Lab CEO and founder Shaw Yeung. Nobody would answer our questions.

Now, the company is finally breaking its silence, though its response leaves something to be desired.

"We have confirmed the core issues ide …

Read the full story at The Verge.

Amazon Web Services logged attempts to leverage the internet-melting PHP2Shell bugs four days ago. They’re now being “broadly exploited” across the internet.

Alice Weidel, co-leader of the far-right Alternative for Germany party, told European lawmakers on Wednesday that Russia and Ukraine need to negotiate a peace deal, while insisting that German businesses require access to cheap Russian energy to remain competitive.

“It isn’t about capitulating to Russia, far from it, absolutely not, but we want people to sit down around the table. It’s high time they did, and went into it with a sensible diplomatic approach, making sure we pay due regard to the interests of both Ukraine and Russia,” she told a press conference.

Four and a half years since Russia launched its war on Ukraine, President Donald Trump is pressing Kyiv to negotiate with Moscow, while Russian President Vladimir Putin agreed on Wednesday to resume trilateral talks with Ukraine.

Weidel made the comments during a visit to the European Parliament in Strasbourg, where she unveiled her opposition AfD party’s EU program at an event organized by the far-right Europe of Sovereign Nations group.

The party aims to shrink the Commission, turn the European Parliament into an assembly of delegates appointed by national parliaments, and seek an opt-out for Germany from EU policies it can’t reform to its liking — potentially including an exit from the Schengen border-free travel area, she told reporters.

During an event following the press conference, Polish MEP Tobiasz Bocheński, from the right-wing European Conservatives and Reformists group, asked what she thought of Poland’s fears regarding Russia. Weidel said her party “puts German interests first,” insisting that “now we are in a critical phase that our industry is dying without Russian gas and oil.”

Germany needs “a sustainable, reliable and cheap energy resource that has been guaranteed by Russia for the last four decades,” she added, claiming that sanctions on Russia have “destroyed” Germany’s “business model.”

German industry is shedding jobs amid high energy costs, Chinese competition and U.S. tariffs, while Chancellor Friedrich Merz continues to push for reforms to revive a stagnant economy.

Weidel said that Russia, the U.S. and China are the only ones steering talks on Ukraine while European leaders aren’t even invited to sit at the table. The EU should have pushed for peace since the start, she added, as “four years down the road, it’s in a much worse position going into negotiations with Russia.”

EU countries are discussing who should represent them at the negotiating table. European leaders have repeatedly said that any decision on a peace deal must involve Ukraine and must include security guarantees.

Asked whether she was in contact with France’s far-right National Rally to repair ties, Weidel said the AfD was “pragmatic.” The French party broke with the AfD in 2024 and later helped shut it out of the far-right Patriots group amid concerns about its extremism and stance on Russia.

“We need to work together on a European unique level, and therefore we need to be in talks and discussions,” Weidel said, adding: “And we are.”

Two bugs found with AI are behind major issues today for 4chan, DeviantArt, Wikipedia, and the blog where the bar around the corner posts pictures of people's dogs. The "critical vulnerabilities" were discovered in the PHP programming language, which underpins much of the internet, including any site built on WordPress. But it's far bigger than that. Some Dutch and Finnish government agencies took their sites down as a precaution. The NSA Cybersecurity account on X recommended that organizations take their systems offline if "an immediate update is not feasible," as did the UK's National Cyber Security Center. Even Pokémon Home and Pokémon C …

Read the full story at The Verge.