• PHP, the open-source computer programming language, had two major vulnerabilities exposed.
• Yonaton Keller woke on Wednesday to panicked messages about the two PHP vulnerabilities.
• He shares three steps you can take to protect your website.

This as-told-to essay is based on a conversation with Yonaton Keller, a 46-year-old product manager at Zafran Security, based in Tel Aviv. His words have been edited for length and clarity.

When I woke up at 6:30 a.m. on Wednesday, I had multiple messages from around 4:45 a.m. alerting me that two vulnerabilities in the PHP programming language had been disclosed.

I immediately understood that this was a very serious situation.

Websites run different versions of PHP, and it's estimated that around 70% of websites worldwide use it. This isn't the first time PHP vulnerabilities have been found, but these ones require essentially no authentication on the attacker's part.

It's a very tricky situation. If it were a year and a half ago, nobody would have really responded to this so urgently. But this might be one of the first major incidents of its kind in this AI era, and the cycle of how attackers operate and how we typically respond is broken.

AI enhances detection and response times, but it also means that any limited-technical person could exploit these vulnerabilities within minutes.

My team was very concerned and had to act fast

I'm based in Israel, so when it was 6:30 a.m., my time, it was the middle of the night in the US. This time gap worked in our team's favor, as we had time to figure out what was going on before our customers woke up.

PHP is an open-source computer programming language used to create websites and web applications. It's such a widely used programming language that we immediately understood that every one of our customers, which includes major corporations and businesses, would likely be affected by this.

With bugs or critical flaws in the infrastructure, like the two that were found in PHP, exploitation is actually quite easy, especially if you use AI agents. That was the first thing we understood: even completely unskilled attackers can use these vulnerabilities to take down sites.

The PHP Foundation said it would disclose the details of the vulnerabilities and release a fix for newer versions of the language around 5 p.m. Israel time. But some details had already been informally disclosed on an online forum. The post was deleted minutes afterward, but screenshots spread around the internet quite quickly in unofficial forums.

So, my team and I dropped everything else and spent all day on Wednesday gathering informal information to see whether we could mitigate the risk of exploitation before an official fix was released.

How to tell if you're at risk

The first step people can take to figure out if they're impacted is to look at their websites and web applications, and try to understand where PHP is involved. You can also assume that most, if not all, of them will use PHP in some way, unless you have very basic HTML-based pages.

The second step would be to look at what vulnerability scanners online are telling you. Tenable, Qualys, and Rapid7 are usually the big three for releasing detection rules and actually detecting the vulnerability. In this case, these vulnerabilities have caused such widespread panic worldwide that they were quick to respond. This is also a way to understand the exact vulnerabilities in your internet-facing assets.

After taking these steps, immediately look online to upgrade your website to the current PHP version. It's quite easy to upgrade that, and it's free. There are some technical steps to do after the fix, so you might need a tech guy to implement them. If you don't update your PHP version, the impact on your business and website can be very, very serious.

Some people are also fully taking their sites offline, and I think that can be the right call if you have evidence that you are being targeted. However, 70% of the internet can't and shouldn't be taken offline just because those sites have some vulnerabilities. It's an emergency step to take if you have evidence of potential exploitation, but it can't be a step taken by everyone.

This was not just about attackers disrupting your website or web application; it was about them taking control of your server, stealing sensitive documents, moving inside your network, and then carrying out malicious operations, such as deploying ransomware or other actions they intended.

The situation has calmed down, but my cybersecurity team is still very concerned

Things have calmed down a bit since Wednesday, but we're still very, very concerned. Patching 70% of worldwide websites doesn't take a minute or two.

Hours after the fix was disclosed by the PHP Foundation, there were already tons of exploitation attempts popping up online. Attackers are getting quicker. I think that in this AI era, when in a matter of minutes, many attackers can attack, you don't have the time you used to.

The whole traditional process of scoping the attack surface, establishing a remediation plan, then calling a guy who's going to be responsible for this remediation plan, et cetera, is broken.

For a long period of time, organizations were investing a lot in what we call post-compromise scenarios. I think the AI era of cybersecurity will involve a lot more security investments in the pre-compromise realm, so defenses can be pre-built and ready for attacks in situations like this.

If you're reading this, then the internet still works. But that's something that we shouldn't necessarily take for granted after this week's global cybersecurity meltdown.

"Think of it this way: someone discovered that millions of buildings in the country have the same broken lock, and now everyone knows how to open it," writes Matt Shumer in a lengthy post on X about the situation. "The lock maker has sent out a fix, but every building owner has to install it themselves, and many haven't yet."

That massive vulnerability was identified with the help of AI, but the growing capabilities of AI-powered hackers mean that vulnerabilities can be exploited much more rapidly too.

This is the world we live in now. In August, more than 100 tech companies signed a letter warning about exactly this possibility. On Thursday, one of Anthropic's top information security officers wrote that cybersecurity threats "are going to get a lot worse before they get better." Major banks are rushing to secure themselves after reports of autonomous agents operating inside accounts (though many of them may have been authorized by account holders).

This is unlikely to be the last incident like this. Cybersecurity firm CrowdStrike says it saw twice as many "agentic intrusions" (hacking done by an autonomous or semiautonomous AI) in August as in July, and then the number doubled again in September.

Scary stuff, for sure. As is usually the case, however, prevention is better than panic.

Shumer's post contains many helpful suggestions for better online security—it is particularly important to secure your email accounts, since that is the gateway to so much of what we do online. Here's a 15-step plan to stay more digitally secure in the AI age. (And if you're really worried about everything falling to bits, Reason's got you covered there too.) If your devices and browsers have updates available, install them. And for the love of digital gods, don't click on random links in strange emails!

The man who (maybe) saved the internet? There is an old XKCD webcomic—and I'm dating myself as a very specific type of millennial by even referencing that—that seems to perfectly sum up what happened this week. Here it is:

Here's the craziest part: That's basically true! Except the one random person lives in Czechia instead of Nebraska. His name is Ondřej Surý, and The Atlantic's Charlie Warzel found him:

Surý, who lives in Czechia, does not work for the PHP Foundation. But alongside his day job as director of domain-name-system engineering at the nonprofit Internet Systems Consortium, in a volunteer capacity, he maintains and helps automate patches for the coding language. His work, with that of just a handful of others, has allowed countless websites and organizations to fix these vulnerabilities quickly. Over the past 48 hours, he's become arguably the unsung hero of the entire internet—despite the fact that the only compensation he receives is from modest donations. "Ondřej will save the internet today," a user in the PHP Subreddit wrote.

In the war between AI hackers and AI defenders, it's still humans who are the heroes. At least for now.

Art of the steal. Yesterday, in this space, I detailed how voters are fed up with the Trump administration's seemingly endless stream of corruption. But it's been a whole 24 hours, which means there is yet another scandal in the news—thanks to a Vanity Fair article about President Donald Trump's son-in-law Jared Kushner.

The article is an excerpt from a forthcoming book. In it, author Matthew Cole claims that Dutch investigators gained access to Kushner's phone with the help of Russian hackers. The evidence from the phone and other sources shows that Kushner has been taking money from the governments of Saudi Arabia and the United Arab Emirates to "push their agenda with Trump."

Kushner says the article's claims are "outrageous and categorically false."

But wait, there's yet another corruption story. The Justice Department is reportedly probing whether Trump ally Corey Lewandowski profited from his role as a top adviser at the Department of Homeland Security (DHS). The Washington Post reports that the investigation is based on a referral from the DHS inspector general and is focused on "contracting fraud."

It may or may not be connected to other allegations that surfaced in September, when The Wall Street Journal reported that Lewandowski approached officials in Qatar and the UAE about being hired to help with "visa issues" and other matters.

In both matters, Lewandowski has denied the allegations. He's no longer working for the department, having been fired earlier this year amid a messy scandal involving then–DHS Secretary Kristi Noem, who was also canned.

Scenes from Virginia: Federal prosecutors indicted state Sen. L. Louise Lucas (D–Portsmouth), one of the most powerful Democrats in Virginia, on charges of racketeering and money laundering in connection with illegal marijuana sales. (Don't get me started on how dumb it is that recreational marijuana use has been legal here since 2021, but commercial sales are still forbidden. If it's legal to use something, it should be legal to sell it!)

Lucas pushed the failed Virginia redistricting effort and has been an outspoken critic of Trump. She plans to fight the charges. Virginia Gov. Abigail Spanberger, also a Democrat, said in a statement that the timing of the indictment, just days before the midterm elections, "further erodes the trust the American people deserve to have in the Department of Justice."

QUICK HITS

• "The last thing José García-Sorto remembers after being shot in the chest is being pulled from his car, pinned to the pavement and handcuffed, his blood pooling around him on a Phoenix interstate. All he could think about was what would happen to his two young children if he died." The New York Times has a harrowing account of a Honduran immigrant who was shot by immigration officers last year. He's never been charged with a crime in connection with the incident, which suggests "the authorities did not find evidence that he had put anyone in danger."
• Phil Magness and David Hebert debunk the notion that tariffs can help "infant industries" grow and succeed in a global market.
• The Cato Institute's annual ranking of "Freedom in the 50 States" is out. Arizona takes the top spot. How did your state do?
• Is alchemy real now? A California company claims it has successfully turned mercury into gold.
• The World Series begins tonight, and it ought to be terrific. Despite low payrolls, Tampa Bay and Milwaukee were the top teams in their respective leagues this year. They are deep, talented teams full of characters worth cheering—Brewers' star pitcher Jacob Misiorowski is a huge Pokémon nerd; Rays' star hitter Yandy Diaz escaped from Cuba after being imprisoned there. And this is the first World Series since 1980 to match two franchises that have never won a championship.

The post The Man Who Saved the Internet appeared first on Reason Magazine.

• Nick Woodhead said he went 48 hours without sleep while helping patch a major website vulnerability.
• The CTO said that with security problems piling up, October feels like "the month of hell" for tech.
• Because AI makes it easier to find and exploit security gaps, Woodhead expects more disruption.

This is an as-told-to essay based on a conversation with Nick Woodhead, founder of the AI company GPTree and chief technology officer at Rothco and Compubox. He spoke with Business Insider on Thursday to share how he's responded to vulnerabilities in the PHP programming language that could affect the majority of the world's websites. The following has been edited for brevity and clarity.

It's always a nightmare when these things happen. Since Tuesday evening, I haven't slept. It's coming close to 48 hours working on this. I'm a CTO, but I also run an agency for multiple clients and have my own company with my own product. So, balancing my time to get everything updated — it's just been exhausting.

About 70% of the internet runs on a programming language called PHP. I'm actively involved within the PHP community itself, so I did get a warning on Tuesday evening regarding the vulnerability and the fact that it was already being addressed by the PHP team. That gave me a head start.

I have some teams offshore, so I was able to jump on that with them.

It's not just applying the patches. It's making sure that nothing was already exposed. We already had infrastructure in place to easily deploy patches, but it still requires a good amount of manual involvement.

I knew that as soon as I walked into the office on Wednesday, I'd have to have my teams jump on this. They were already waiting for the patches to be released.

People are willing to help

One of the biggest headaches, especially on the client side, is that we have a lot of legacy systems, which are running on older versions of PHP that are no longer supported, and official patches are not going to be produced. For those, we ultimately had to come up with other plans. For example, taking sites temporarily offline or moving them behind VPNs.

Eventually, because it's an open-source community, those patches have already been backported, or implemented, by the community. So now we're shuffling back to some of those older systems to get them patched.

That's one of the nice things about PHP. There's such a vast community of people all willing to roll up their sleeves and jump in and help.

Even though I've been in leadership for the last 10 years, I've never taken my hand off the pulse in terms of being connected with the code and the infrastructure. So, I've been hands-on with the development and infrastructure teams to help make sure these issues are resolved. We've been reviewing logs and looking for any potential signatures of a breach that this vulnerability exposed.

The month of hell

It's also meant keeping up to speed with the latest news that's coming out and what other people are finding. We're in a position now where we feel comfortable and safe, but there are new vulnerabilities in the coding tool Node.js. We have some Node services, so now we're looking at how that potentially affects us. October just seems like the month of hell from a technology perspective.

I don't think there is an end in sight with the advancements in AI. For all the positives we get from it, there are a whole bunch of negatives, and this is a perfect example.

OpenAI has already stated that they found many more of these types of vulnerabilities that, thankfully, haven't been leaked. Over the coming months, they are either going to be patches or this information is going to get leaked in the same way and cause the same kind of panic.

I don't think we're at the end of the road yet. There's going to be a lot more to come.

• This week's cyber freakout explained: AI is making software weaknesses easier to find and exploit.
• The message from Cloudflare's Stephanie Cohen and Vercel's Tom Occhino: Don't panic!!!
• Do we need everything connected to the internet? Paper bank statements work well.

A few weeks ago, I heard a strange story about a friend who works at one of the Big Tech companies in Silicon Valley.

She'd recently ripped out the connected devices in her home, ordered paper bank statements, and stocked up on canned goods in her basement.

Now, she's a very sane, experienced person, and quite senior at one of the largest internet companies on earth. Why was she disconnecting so much? Just to be sure, my family ordered paper bank statements, too. It was still a head-scratcher, though.

Fast forward to this week, and her actions look a little less crazy.

AI models have exposed serious security weaknesses in software used by roughly 70% of websites. Meanwhile, US banks are finding AI agents inside customer accounts, including some that appear to be acting without their owners' instructions, Axios reported.

'Black October'

The digerati have now entered full freakout mode. Much of the internet meltdown is happening on, well, the internet, my colleague Alice Tecotzky noted.

On X and Reddit, warnings of a looming “Black October” spiraled into visions of AI grinding civilization to a halt. One lengthy post on X warned of a potential “global cyberattack/AI swarm” and offered a survival checklist: Stockpile cash in small bills, print out your neighbors' phone numbers, download maps, buy a hand-crank radio, and stash a gallon of water per person per day.

Oh, and don't forget the manual can opener. You don't want to survive the AI apocalypse only to be defeated by a tin of beans.

Nikita Bier, a prominent app developer and former head of product at X, best captured the mood.

"It's time to turn off the internet," he posted Wednesday night.

A Cloudflare exec says it's 'a little bit scary'

If you're reading this, you haven't done that yet. But should we really be worried?

I put that question to Stephanie Cohen, chief strategy officer at Cloudflare, which helps protect about 20% of the internet.

"The world is a little bit scary right now," she told me on the side of Cloudflare's annual conference in San Francisco this week.

Here's the problem. The internet is built on decades of software, much of it riddled with security holes.

Some of these weaknesses have been known for years. However, fixing them takes time and money, and hackers often lacked the skills to exploit them anyway. So they were left alone.

AI changes that calculation dramatically. Someone who previously needed years of training to break into a computer system can now get help from an AI model. And these tools can search for weaknesses at a speed humans simply can't match.

The result: The number of newly published software vulnerabilities (Common Vulnerabilities and Exposures in industry lingo) has exploded.

Now, there's a frantic race between people trying to break into systems and those trying to protect them.

Don't panic about AI

Cohen's message, though, was surprisingly reassuring.

AI helps the good guys find and fix these problems. Cloudflare, for instance, released protections for the latest vulnerability to customers, including those using its free service.

And there's a bigger effort underway.

OpenAI has launched an initiative called Patch the Planet, working with Cloudflare and other security professionals to use AI to find weaknesses in widely used software and help repair them.

Tom Occhino, chief product officer at Vercel, told me recently that his company has been talking with partners about launching a nonprofit that would fund a swarm of good AI agents that go out on the internet to find and fix software flaws.

Amazon is joining the fight, too. Its new Continuum service, available Thursday, uses AI agents to find security holes and propose fixes. Amazon said that people maintaining freely available software can use it to help protect the wider internet.

Humans may still have to check and approve these repairs, but the prospect of AI helping clean up decades of neglected software is encouraging.

The irony of this is not lost on some in the industry.

"The funny thing is everyone was saying AI slop code will cause a cyber crisis but it's actually all the old human slop causing it and the AI is just cleaning it up," software engineer Ben Kaufman wrote on X on Thursday.

Either way, Cloudflare's Cohen thinks these AI-inspired freakouts will push the industry to do better — by exposing issues and adding urgency to get them patched.

"We may end up in a world where actually we've become significantly more secure at the end," she said.

The trouble is getting there.

A fundamental question about the internet

When I ran into Occhino recently at a Vercel conference in San Francisco, he described a world in which software that everyone assumed was safe suddenly looks vulnerable because increasingly capable AI models are scrutinizing the basic systems that underpin the internet.

That led to a more fundamental discussion between us: Why did we connect so many things to the internet in the first place?

For years, the technology industry has raced to put everything online. Thermostats. Refrigerators. Doorbells. Cars. Bank accounts.

We assumed that connecting something to the internet automatically made it better.

Perhaps we should reconsider.

Before the internet

I remember the world before the internet. It worked pretty well. We managed to buy groceries, pay bills, heat our homes, and generally get through the day without every appliance talking to a computer somewhere.

That doesn't mean abandoning online banking or throwing your smartphone into the sea.

Occhino, for one, isn't particularly worried about hackers wiping out his bank account. Modern banks have sophisticated protections, and he recommends everyone turn on additional login security.

Maybe the cybersecurity crowd, which spends its life immersed in online threats, is missing something obvious.

Not everything needs to be connected.

Occhino put it neatly: "There's certain things that don't make sense to be on the internet in the first place."

Perhaps that's the lesson from this week's panic. We don't need to turn off the internet.

We just need to remember where the off switch is.

Alice Tecotzky contributed reporting.

Sign up for the AI Insider newsletter here. Reach out to me via email at abarr@businessinsider.com

• Execs and analysts are sounding the alarm after AI discovered a flaw affecting the majority of the internet.
• Experts say critical systems, from energy and water to healthcare, may be especially exposed.
• Here's what smart people are saying about the biggest threats to the internet at the moment.

It's been a nightmarish week for cybersecurity.

AI helped discover two "critical" flaws in the infrastructure of PHP, a programming language that up to 70% of websites use, prompting companies to race to roll out a fix or risk being hacked.

The incident has illustrated how AI is creating a new level of risk for businesses and consumers online, in a week when multiple other cyber threats caused headaches for security workers.

Here's what executives and analysts are saying about the biggest cyber threat of the moment — and how AI could make things even worse.

Jason Clinton, Anthropic's deputy chief information security officer

Anthropic's deputy security chief, Jason Clinton, warns that a "vulnerability tsunami" is coming — and says critical infrastructure hasn't caught up.

Clinton posted on X on Wednesday about the need to "patch critical infrastructure" before core network vulnerabilities get exploited. On Thursday, he issued another warning to companies.

"As bad as things have gotten in the past 4 days, they are going to get a lot worse before they get better," he wrote.

"Security leaders, never let a crisis go to waste: please go to your boards and ask for help right now. not for ai, for the basics. (we need to hold on for ~18 months.)," he added.

Andrew Curran, AI analyst

Andrew Curran, a prominent AI analyst, weighed in on several cybersecurity threats from Wednesday to Thursday.

"Regarding potential attacks on energy, food, and water infrastructure, the threat is quite real. Someone is currently probing infra and feeling it out, it is an active threat. Even a little preparation can be helpful, just in case," Curran wrote on Wednesday in response to an NSA cybersecurity advisory about threat actors.

On Thursday, Curran also highlighted a hack of Quest Diagnostics, which he said serves "roughly half" of the US's hospitals and physicians.

Matt Shumer, AI investor

In February, Matt Shumer, the former CEO of Hyperwrite, published a viral essay on his website titled "Something Big Is Happening," in which he warned of large-scale disruptions wrought by AI that could upend the world order.

Shumer published another essay on Thursday on his website and LinkedIn, this time titled "The Internet Is Under Attack. Here's How to Protect Yourself and Your Family."

"Right now, as you read this, swarms of AI agents are likely trying to break into the websites you use. Not one of them. Many of them," Shumer wrote. "We are in the middle of the biggest cybersecurity moment in years."

This is what could happen, per Shumer's post:

Your information leaks, so scammers know your name, birthday, address and bank, and their calls and texts sound real. Your accounts get taken over through some site you used once, years ago, with the same password you use everywhere. And the things you depend on, like an app, a pharmacy or a store's website, go down for days.

To be clear: this is ongoing, but the worst-case scenarios people are most scared of haven't happened. I hope they never do. But it's better to be safe than sorry, especially since this is going to keep happening.

Shumer also outlined four ways people can protect themselves, including updating all their software and staying off sites they're unfamiliar with while companies and websites alike make their security updates.

He also advises that people protect their bank accounts by being extra cautious about any and all codes and links that they receive. People should also "close the doors you aren't using" by unplugging smart gadgets and deleting apps that aren't being utilized.

"Every connected thing is another way in," Shumer wrote.

Marc Benioff, CEO of Salesforce

Marc Benioff agreed with Anthropic's Jason Clinton in an X post on Thursday.

"Jason is 100% right. Code red," Benioff wrote, along with a red alarm emoji.

Sriram Krishnan, venture capitalist and former White House advisor

Sriram Krishnan, a prominent venture capitalist and former senior AI policy advisor for President Donald Trump, said that the PHP vulnerabilities are a "harbinger of things to come" as AI models continue to detect long-standing cyber issues.

"However the entire software supply chain will need the muscles to rapidly build and deploy fixes," he said in a post on X.

The new cyber reality may require more public-private partnerships to build the required infrastructure, he said.

Deedy Das, venture capitalist

The Menlo Venture partner Deedy Das warned that "the era of vibe hacking is here" in a series of posts on X.

He said he'd seen firsthand that "even non-technical people" can exploit common vulnerabilities, such as PHP, using AI models. Das said someone could theoretically direct certain models to any website and instruct them to quickly locate the vulnerabilities.

"Once you figure it out, it is downright trivial to do. The digital infrastructure of the world is at risk," he wrote.

Aaron Levie, CEO of Box

AI agents have ended the era of "security through obscurity" because they can devote once-unthinkable time and effort to finding vulnerabilities, Box CEO Aaron Levie said on X. People will need to upgrade legacy infrastructure, modernize security policies, and tighten access controls, among other measures, he said.

"Agents will help on the defensive side because they can both accelerate this work and equally simulate the risk vectors," Levie wrote.

Yet Levie thinks humans also have an important role to play in the cyber revolution — he predicted a boom in cybersecurity jobs, which could become a huge investment area for companies.

"You will need more talent to point the agents at the most critical work, review findings, patch systems, respond to incidents, and more," he said.

• Cybersecurity researchers say the PHP vulnerability has repercussions for normal people, too.
• Even if you don't own a website, hackers could use the vulnerability to steal your information.
• One quick fix: diversify your passwords.

If you're still using the same password for everything, it might finally be time to get on that.

While the major cybersecurity vulnerabilities that OpenAI agents helped expose on Wednesday primarily impact the owners and operators of websites, it could also give hackers the opportunity to hijack your personal information, researchers said.

"Be extra careful visiting ANY web site in the next few days," Changpeng Zhao, the cofounder of cryptocurrency platform Binance, said on X.

OpenAI said on Wednesday that researchers using its AI models uncovered two "critical" flaws in the infrastructure of PHP, a popular open-source programming language used on about 70% of the world's websites.

Because digital commerce websites, for instance, can store personal shopper information in PHP systems, that information would be accessible to a bad actor exploiting the web provider's system if that provider hasn't updated it.

The National Security Administration warned that hackers using one of the PHP exploits could "steal sensitive data, disrupt services, or move deeper into a network."

"Even if you yourself are not building software and that's not where your core business is, a lot of your life does depend on companies that depend on those systems," Madeline Lawrence, cofounder of Aikido Security, an application security platform, told Business Insider on Thursday.

"And they could be deeply, deeply vulnerable," she added. She said that one day after the disclosure, cybersecurity platform Cloudflare reported millions of attempts to exploit the vulnerability.

If you do own a website, PHP has released updates it says will help shield websites from hackers. Instructions for applying those updates are available on PHP's homepage.

For everyone else, here are a few tips cybersecurity researchers say you can use to protect your info.

• Don't reuse passwords; use a password manager.
• Check for security advisories from your bank.
• Use two-factor authentication on your devices and accounts — especially for email, banking, and your password manager.
• If your data has been breached, expect more convincing scams and phishing emails.
• Turn auto-updates on and restart your computer weekly.

"You can ask your claude code to audit what on your laptop is out of date and needs updating," Peter Wildeford, head of policy at the AI Policy Network, a bipartisan nonprofit that advocates for safety guardrails and federal oversight, added in a post on X.

Though Lawrence called the vulnerability "very severe," she cautioned against people running to close their bank accounts to protect themselves.

"Assume that if you're getting a notification that your data has been leaked," she said. "Take action on that because you could have credentials or information floating around the dark web."

The European Union has taken a significant step towards revising its digital regulatory framework after member states agreed proposals to amend the General Data Protection Regulation (GDPR), simplify cookie consent requirements and overhaul cybersecurity reporting obligations.

The Council of the European Union adopted its negotiating position on Wednesday, 21st October, clearing the way for negotiations with the European Parliament once MEPs establish their position.

The measures form part of the European Commission’s Digital Omnibus package, introduced in November 2025, and represent one of Brussels’ most substantial attempts to simplify the regulatory obligations imposed on businesses operating across the single market.

Changes to GDPR and personal data rules

The proposed reforms would modify several provisions of the GDPR, which has governed the processing of personal data across the EU since May 2018.

Rather than replacing the legislation, the Council wants to clarify existing obligations, particularly those concerning pseudonymised information, requests for access to personal data and the use of information in scientific research.

The agreed position retains the existing definition of personal data while introducing provisions intended to clarify when pseudonymised information can be linked to an identifiable individual.

Companies would also benefit from simplified procedures for handling manifestly unfounded or excessive data requests and from reduced information requirements in certain low-risk circumstances.

Another proposed change would extend the deadline for notifying authorities of personal data breaches, while establishing more consistent reporting templates across the EU.

For multinational companies, which currently navigate different interpretations of data protection obligations by national authorities, these provisions could reduce compliance costs and administrative duplication.

However, the changes have raised concerns among European privacy regulators.

In a joint opinion published in February, the European Data Protection Board and European Data Protection Supervisor warned that parts of the Commission’s original proposal could create legal uncertainty and undermine existing protections.

They were particularly concerned about proposals affecting the definition of personal data and the Commission’s potential role in determining when pseudonymised information falls outside GDPR requirements.

The Council’s decision to retain the existing definition addresses part of that debate, although the final legislative text remains subject to negotiations.

Fewer cookie banners for internet users

One of the most visible changes would affect the consent notices encountered by Europeans when visiting websites.

Under the Council’s proposal, additional categories of cookies and similar tracking technologies could be used without obtaining explicit consent, provided the relevant legal conditions are satisfied.

The proposed exemptions include technologies necessary to deliver a service, maintain device security or conduct audience measurement.

For website operators, publishers and online businesses, the changes could reduce the number of consent requests displayed to visitors and simplify technical compliance.

The current system has generated extensive legal disputes over whether consent is genuinely voluntary and whether tracking technologies collect information beyond what users have authorised.

EU Today has previously examined the enforcement of these obligations, including a Belgian court ruling concerning the legality of the advertising industry’s consent framework.

The latest proposal would not abolish consent requirements for commercial tracking or behavioural advertising. Technologies falling outside the permitted exemptions would remain subject to the applicable privacy rules.

Cybersecurity reporting and artificial intelligence

The package also addresses the growing number of reporting obligations imposed on European businesses under overlapping cybersecurity legislation.

The Commission originally proposed a single European reporting mechanism for certain data and cybersecurity incidents.

Member states have instead agreed to establish national entry points, supported by an EU-level information system and provisions for coordinating cross-border notifications.

The Council’s position would also clarify the legal grounds for certain uses of personal data in artificial intelligence systems and introduce safeguards for processing sensitive information in specified circumstances.

These provisions follow increasingly complicated disputes over the application of European privacy legislation to AI development and automated decision-making.

As EU Today reported in its coverage of a major GDPR enforcement case involving Uber, automated processing already presents substantial compliance risks for companies operating within the bloc.

Competitiveness drives regulatory reform

The Commission estimates that its wider digital simplification initiative could save European businesses up to €5 billion in administrative costs by 2029.

The initiative reflects pressure from European governments and business organisations to reduce the regulatory fragmentation that makes operating across multiple EU jurisdictions more expensive.

The Digital Omnibus is part of a broader legislative programme influenced by the competitiveness reports produced by former Italian prime ministers Enrico Letta and Mario Draghi.

Under the Council’s negotiating mandate, several existing data-related rules would also be consolidated, while provisions governing the protection of trade secrets would be strengthened.

The European Parliament must now determine its negotiating position before formal discussions between the institutions can begin. Until the legislation is agreed and adopted, existing GDPR, cookie consent and cybersecurity requirements remain in force.

Dutch-Belgian supermarket group Ahold Delhaize has confirmed that malicious activity was responsible for the cybersecurity incident that disrupted its operations across Europe and the United States, forcing the company to take websites, applications and other computer systems offline.

In an official statement issued on Monday, 19 October, the company announced that it had filed a formal complaint with Dutch police and was cooperating with national cybersecurity authorities. Although physical supermarkets have remained open, the disruption has affected online shopping, deliveries and some distribution operations.

The company said investigators had so far found no evidence that sensitive information belonging to customers, employees or business partners had been taken. However, its investigation remains open, and the identity and objectives of those responsible have not been publicly established.

Online services interrupted across several countries

The disruption began on 12 October, when Ahold Delhaize detected suspicious activity within its information technology infrastructure.

The group responded by taking a number of systems offline as a precaution, affecting most of its retail brands in Europe and the United States. The consequences varied considerably between businesses, with some experiencing prolonged interruption to digital services while others were able to restore operations more quickly.

Albert Heijn, the Netherlands’ largest supermarket chain, has been particularly affected. Its website and mobile application have returned online, but home grocery deliveries are not expected to resume until Friday, 23 October.

Orders scheduled before that date have been cancelled, while the company continues preparations for a gradual restoration of its online delivery service.

The incident also interrupted some supply and distribution arrangements, resulting in shortages on supermarket shelves in parts of the Netherlands and Belgium.

In Belgium, Delhaize has restored its online shopping operations. Certain promotional and personalised services were still experiencing difficulties, although the parent company confirmed that its Belgian e-commerce business was operational again.

Dutch retailers Etos and Gall & Gall have also restored their websites. Meanwhile, several American supermarket brands owned by Ahold Delhaize have continued to experience service interruptions.

The group said it expected additional online services in the United States to become available over the coming days.

Dutch authorities investigate

Ahold Delhaize said it notified the Netherlands’ National Cyber Security Centre within 24 hours of detecting the malicious activity.

The company has subsequently provided updates to the authorities and, on Monday, confirmed that a formal police report had been submitted.

Chief executive Frans Muller defended the decision to shut down digital systems, arguing that the investigation had demonstrated the necessity of taking preventive action.

The company has not identified the perpetrators, confirmed whether ransomware was involved or disclosed the technical method used to gain access to its infrastructure.

These distinctions are important because malicious activity does not necessarily establish that information was stolen or that attackers obtained control over every system subsequently taken offline.

The retailer has instead described a controlled restoration process intended to ensure that affected systems can be brought back into operation without exposing the business to further risks.

Ahold Delhaize operates thousands of supermarkets and related retail businesses, including Albert Heijn, Delhaize, Food Lion, Giant Food, Hannaford and Stop & Shop.

Its geographical reach means that a disruption originating within shared corporate infrastructure can affect several national markets, even where individual retail chains maintain separate commercial operations.

Cybersecurity becomes a supply-chain concern

The attack comes amid increasing scrutiny of the vulnerability of European food retailers to digital disruption.

Earlier this month, investigators in France began examining cyberattacks against refrigeration control systems used by hundreds of supermarkets.

Those incidents reportedly affected equipment at chains including Carrefour, Intermarché and Monoprix, with some retailers forced to discard products after refrigeration systems malfunctioned.

There is no established connection between the French incidents and the attack affecting Ahold Delhaize.

Nevertheless, both episodes illustrate the dependence of modern retail operations on interconnected digital systems supporting stock management, refrigeration, logistics, payments and customer services.

The consequences of a serious cyber incident can extend beyond the loss of access to websites. Interruptions to inventory systems, warehouse operations or communications with suppliers can affect the availability of physical products.

This creates particular difficulties for food retailers, where delays in transport and storage can result in the loss of perishable goods.

European regulatory implications

The incident also draws attention to the European Union’s NIS2 cybersecurity framework, which establishes stricter risk-management and incident-reporting obligations for organisations operating in designated sectors.

Food production, processing and distribution are among the activities covered by the directive, although its application to particular companies and operations depends on the relevant legal definitions and national implementing arrangements.

The legislation requires organisations within its scope to establish appropriate cybersecurity protections, address supply-chain risks and notify competent authorities of significant incidents.

Separately, the General Data Protection Regulation establishes notification requirements where personal-data breaches meet the relevant reporting threshold.

Ahold Delhaize’s statement that it has found no evidence of sensitive data being taken does not conclude the technical investigation, but it means that a confirmed theft of personal information should not presently be presented as a fact.

For the company, the immediate challenge remains restoring online services while maintaining normal supermarket operations. The wider commercial consequences, including the cost of the interruption and its effect on sales, have not yet been quantified publicly.

A cyberattack affecting approximately 700 supermarkets in France has exposed serious weaknesses in the digital systems used to control commercial refrigeration, raising concerns about the vulnerability of European food distribution networks and other essential infrastructure.

The attack began overnight on 11–12th October, when intruders gained access to remotely managed refrigeration equipment and altered operating settings, causing refrigerators and freezers to overheat.

Stores belonging to several major supermarket chains were affected, including Intermarché, Netto, Coopérative U, Carrefour and Monoprix. Some were forced to discard substantial quantities of fresh and frozen food.

French Finance Minister Roland Lescure confirmed that approximately 700 of the country’s 10,000 supermarkets had been affected, although the severity of the disruption varied between locations.

The Paris prosecutor’s office has opened an investigation into the attack, including the damage caused by destroyed merchandise and reported fires.

The incident has drawn attention to industrial control systems that are routinely connected to the internet but may receive less cybersecurity protection than corporate networks and customer databases.

Refrigeration systems remotely manipulated

Investigators have established that refrigeration equipment was targeted through vulnerabilities associated with remote monitoring and control systems.

The French cybersecurity authorities identified compromises involving products supplied by Danish manufacturer Danfoss and American company Copeland.

Some of the affected systems used older equipment that no longer received regular security updates.

According to information released by the companies and cybersecurity specialists, certain industrial controllers had been accessible through public internet connections, creating opportunities for unauthorised access.

Hackers reportedly manipulated defrost cycles and increased temperature settings, preventing equipment from maintaining the cold conditions required to preserve food.

The attack affected approximately 300 Intermarché and Netto stores, while Coopérative U reported disruption at around 80 outlets.

Several retailers managed to contain the damage, but others lost substantial quantities of stock.

The consequences extended beyond malfunctioning equipment. Businesses faced the cost of replacing spoiled food, repairing refrigeration systems and restoring normal operations.

The precise financial damage is still being assessed, although estimates from the retail sector indicate that losses across France could amount to tens of millions of euros.

Vulnerabilities in connected equipment

The incident illustrates the security problems created by the growing use of internet-connected industrial equipment.

Modern refrigeration installations allow contractors and maintenance specialists to monitor temperatures, adjust settings and diagnose faults remotely.

These arrangements can reduce operating costs and improve efficiency, but they also create additional access points that attackers may exploit.

Cybersecurity specialists have identified vulnerabilities in commercial refrigeration platforms manufactured by Danfoss and Copeland.

The manufacturers subsequently addressed identified flaws, although older or unsupported equipment remained a concern.

A critical problem for businesses is that industrial machinery often remains operational for many years after its original software has become obsolete.

Replacing entire refrigeration installations can involve substantial expense and operational disruption, encouraging operators to retain equipment that may no longer meet contemporary cybersecurity standards.

The risks are particularly difficult to manage when responsibility for maintenance, software updates and network security is divided between retailers, equipment suppliers and external contractors.

France’s delayed cybersecurity legislation

The attack has renewed scrutiny of France’s implementation of the European Union’s NIS2 Directive, which is intended to strengthen cybersecurity across sectors providing important economic and public services.

The directive establishes common requirements covering risk management, incident reporting, organisational responsibility and protection against cyber threats.

Its scope extends beyond traditional critical infrastructure such as energy, telecommunications and transport to include certain businesses involved in food production, processing and distribution.

EU member states were required to incorporate the directive into national legislation by 17 October 2024.

France was among the countries that received a formal warning from the European Commission in May 2025 over incomplete implementation.

French cybersecurity specialists have since warned that delays have complicated efforts to establish consistent obligations for organisations operating industrial and commercial systems.

However, NIS2 does not automatically cover every supermarket. Its application depends on the nature and size of an organisation and the provisions of national implementing legislation.

The incident therefore raises questions not only about the pace of legislative implementation but also about the practical protection of equipment already in use.

Wider implications for European infrastructure

The disruption demonstrates how a cyberattack can cause physical damage without directly targeting a conventional industrial facility.

Unlike breaches intended to steal customer information, the French incident interfered with machinery responsible for preserving essential products.

The distinction is important for European policymakers, who increasingly face threats to infrastructure that combines digital controls with physical operations.

The European Union’s cybersecurity agency ENISA has organised cross-border exercises to test how authorities and companies would respond to disruption affecting essential services.

The attack itself has been established, but responsibility for it has not been publicly attributed.

French authorities have said there is no immediate threat to national food supplies. Nevertheless, the destruction of merchandise and interruption of ordinary retail operations have demonstrated the potential economic consequences of weaknesses in relatively commonplace equipment.

The continuing investigation must establish how access was obtained, which systems were compromised and whether the vulnerabilities were known to operators before the attack.

For Brussels and national regulators, the case provides a practical test of whether European cybersecurity legislation can translate into effective protection for the connected equipment on which ordinary commercial activities increasingly depend.

The most unsettling failure in digital payments may not be a black screen. Imagine a fraud-detection model that remains online but suddenly flags thousands of legitimate transfers as suspicious. Banks may see functioning servers while customers see rejected payments, delayed salaries and complaints no single institution can explain. This is a hypothetical scenario, not a […]

The post The AI risk no bank can manage alone appeared first on Asia Times.

Poland has launched a nationwide security operation after three knife attacks at educational institutions left one woman dead and more than a dozen people injured. Police have detained 117 people amid a wave of online threats, while intelligence officials are examining whether Russian disinformation networks exploited the violence to spread panic.

Poland is confronting an unprecedented school security crisis after a succession of violent attacks by young people triggered widespread fear, school closures and a nationwide police mobilisation. By Sunday, 11 October, officers had detained 117 people and conducted nearly 64,000 security checks at educational establishments, as the authorities attempted to contain both genuine threats and an escalating campaign of intimidation on social media.

The crisis reached its height on Friday, 9 October, when warnings circulated about a supposed nationwide killing campaign known as “Bloody Friday”. Videos, threatening messages and lists of potential targets spread through TikTok, messaging platforms and school discussion groups, prompting parents to keep children at home and several local authorities to suspend classroom teaching.

Although police have found no evidence of an organised nationwide conspiracy, the violence that preceded the rumours was real. Three separate attacks took place between 7 and 10 October, while investigators are examining hundreds of other incidents involving threats or suspected criminal activity.

Two attacks that triggered nationwide panic

The first major incident occurred on Wednesday, 7 October, at a vocational school in Ostrołęka, north-east of Warsaw. A 19-year-old student armed with a machete attacked pupils, teachers and other people in and around the building, injuring nine victims before harming himself.

Investigators subsequently discovered a homemade explosive device inside his backpack. The suspect was arrested, and prosecutors brought nine charges against him, including attempted murder. The discovery of explosives raised further questions about the extent of his preparations and the possibility of a substantially higher death toll.

The following day, a 15-year-old former pupil entered a primary school in Leszczydół-Nowiny, near Wyszków, and attacked three members of staff with a knife. A 37-year-old caretaker died from her injuries, while two teachers, including the headteacher, were wounded.

According to investigators, the teenager wore a helmet-mounted camera, raising suspicions that he intended to record the assault. The official prosecution statement confirmed the victim’s death and the detention of the suspect.

The attacks were followed by threatening messages from other teenagers, including a video attributed to a 17-year-old in the Przasnysz district who claimed to be participating in a competition involving killings. Police subsequently detained him. In Sierpc, another 17-year-old was arrested after allegedly discussing plans for violence at school; officers discovered two knives.

Thousands of schools under police surveillance

The rumours produced an immediate reaction. Schools in Wyszków, Ciechanów, Pułtusk and other municipalities cancelled classroom teaching or introduced remote lessons. Elsewhere, parents independently withdrew their children, leaving some classrooms largely empty.

Police launched an extensive preventive operation, deploying additional officers around schools and investigating online threats.

According to the figures released on 11 October, the authorities had recorded 275 incidents requiring investigation, detained 117 people and carried out nearly 64,000 checks at schools, nurseries and other educational facilities.

The situation deteriorated further on Saturday, 10 October, when a 21-year-old student attacked three people at a post-secondary educational institution in Warsaw. Two 17-year-old girls and a 24-year-old woman were injured. One victim required hospital treatment, although none of the injuries was considered life-threatening.

Interior Minister Marcin Kierwiński subsequently stated that investigators had established no links between the recent attacks. The authorities nevertheless remain concerned about imitation offences, particularly where threatening material circulates among teenagers through closed online communities.

Russia’s possible role in spreading panic

The events have also raised questions about whether hostile foreign actors deliberately amplified the crisis. Tomasz Siemoniak, Poland’s minister responsible for coordinating the intelligence services, warned that Russian organisations routinely exploit domestic emergencies to spread disinformation and undermine confidence in public institutions.

In his statement on 9 October, Siemoniak acknowledged the possibility of foreign involvement but stressed the need for evidence before assigning responsibility.

There is, at present, no publicly established evidence that Moscow organised the school attacks or directed the subsequent threats. Nevertheless, the rapid circulation of alarming videos, fabricated warnings and unverified target lists illustrates how genuine violent incidents can be exploited to disrupt everyday life without further physical attacks.

The episode also presents a challenge for European regulators. Poland is examining measures against dangerous online content, while its existing obligations under the EU Digital Services Act provide a framework for addressing systemic risks associated with major platforms.

For Donald Tusk’s government, the immediate priority is preventing further attacks as schools reopen under heightened security. The longer-term challenge concerns the interaction between online radicalisation, copycat violence and disinformation capable of transforming isolated crimes into a national emergency.