• I'm 30 years old, but I look young and am often mistaken for being half my age.
• This has made it difficult for me to feel like I'm being taken seriously in professional settings.
• Oftentimes, when I apply for jobs or go to the office, I try to make myself look older.

"Have you just started studying?" a tall, smiling man in a suit asked me.

Although I was in a university building, I wasn't there as a student. I was struggling to find a conference room for a work-related meeting — one that, I soon realized, he was also attending. Of course he was.

"Oh, you just look so much younger," he said after he realized we were colleagues. Maybe it was a compliment, but it didn't feel like one to me.

I have countless examples of people perceiving me as half my age, from movie-theater cashiers trying to sell me children's tickets to police officers on the street asking me where my parents are.

There have been several times when I arrived at a youth support group for my job, but the receptionist assumed I was one of the teen clients. It doesn't exactly inspire confidence.

I'm 30, but between my youthful features and my 5-foot-1 height, I am often told I look like a teenager. Many people consider looking young a dream, and it's even a goal for skincare aficionados.

In reality, though, I believe it's made parts of my life — especially my professional life — considerably more difficult.

I've found it's tough to be taken seriously when you look half your age

I have several years of experience providing peer support for individuals with autism and ADHD; helping develop mental-health programs; and leading projects addressing issues faced by refugees, the LGBTQ+ community, and people with disabilities in several countries.

And yet, because of how I look, I still struggle with confidence and worry about being taken seriously at work.

Often, before I've even had the chance to properly introduce myself when interviewing for a job or meeting new people, I'm concerned my appearance has already shaped how I'm perceived.

Looking like a teen feels like an even bigger obstacle when I'm applying for higher-level and leadership roles, especially because most of the work I do involves peer support or management.

A manager is expected to be wise and knowledgeable — qualities not usually associated with youth. And in my field, a peer supporter is someone who has enough lived experience and training to help others navigate situations they have experienced firsthand.

But would a 70-year-old really take advice from someone who looks like their grandson? I don't know, but I do know that appearance and age aren't the same thing as experience.

I try to look older to be taken more seriously, but I wish I didn't have to

Over time, I've developed little tricks to try to avoid unwanted questions (or surprised reactions) about my age at interviews and at work.

Sometimes I wear platform shoes to appear taller or deliberately choose clothes that make me seem more mature — for example, wearing a plainer dark shirt rather than a colorful one, even though both would be equally appropriate for a meeting.

I also find myself consciously steering conversations with work colleagues toward things people associate with adulthood. I'm more likely to mention politics or current affairs than "The Hunger Games" or "Doctor Who," even on days when I would much prefer to chat about sci-fi than the news.

Sometimes I offer to show my ID as soon as I arrive for a job interview, hoping that "proving" my age will immediately change how potential employers perceive me.

In a perfect world, though, people would be judged in the workplace for their actual skills rather than their appearance and age, real or perceived. Age doesn't automatically come with wisdom, and youthfulness isn't equal to inexperience.

I've known teenage peer-support volunteers who were fantastic at their work, and I've also encountered professionals decades older than me who were far from the best in their field.

For now, though, I'm willing to play the game when I need to. I'll wear platform shoes, put away the "childish" T-shirts, and show my ID — whatever it takes to be taken seriously as a professional adult.

An Indonesian taxi driver who went looking for work abroad ended up in Russia's army and died in his first battle in Ukraine, Ukraine's military intelligence (HUR) said. Russian recruiters found him through a job application, and he reached the front in Donetsk Oblast within weeks of signing. HUR calls him one more foreigner drawn into Russia's war through deception.

Russia's war against Ukraine consumes men faster than the Kremlin is ready to replace them through another mobilization at home, so it keeps hiring abroad. Ukraine has identified nearly 46,000 foreigners who signed with Russia's army since 2022. On 26 October, a UN commission found “compelling evidence” that Russia trafficked men from 29 countries into its forces.

A résumé that reached Russian recruiters

Taufiq Muhammad, born in 1978 in Sorong, Indonesia, drove a taxi in Jakarta and had once worked in the US. Russian recruiters found him through a résumé he had sent out while looking for work, the agency said. He probably believed promises of “easy money” and traveled to Moscow. HUR sees his case as part of a pattern.

“In fact, he became yet another victim of Russia's scheme of recruiting foreigners for the criminal war through deception,” HUR said.

A week and a half of training, then the front

Muhammad signed a one-year contract with Russia's army in Korolyov, near Moscow, on 19 April 2026. HUR called that term typical for foreigners Russia uses as “disposable” infantry. Russia made him a machine gunner and gave him only a week and a half at a training center near Voronezh, Army Inform reported, citing HUR.

Russia moved him to occupied Ukraine in early May. He died almost at once, in his first battle. Russian troops were trying to advance from the village of Zelena Dolyna toward Novoselivka and Drobysheve in Donetsk Oblast, Militarnyi reported.

Indonesia is the newest recruiting ground

Russia's recruiters have been working in Indonesia for months. In August, Ukraine's Foreign Intelligence Service said it held documents on at least eight Indonesians recruited into Russia's army.

Another Indonesian, Rendi Apriyanto, 30, was reportedly killed in September, his family learned from an Indonesian fighting for Russia. Rendi had told his family he was recruited for logistics work, The Jakarta Post reported.

HUR has traced the same fast track before. In January, it identified a Filipino recruit killed in a Donetsk Oblast assault after one week of training. A Nigerian, 34, died in Kharkiv Oblast after a similar week of training, HUR said in May.

Russia courts Africa ahead of a summit

Ukraine's Foreign Ministry has counted at least 2,982 Africans recruited into Russia's army, and 486 of them have died. Ahead of a Russia–Africa summit on 28–29 October, Moscow plans military and port-access deals with a string of African states, HUR said. The deals would help expand the campaign of Russia's Africa Corps, the Defense Ministry-controlled force on the continent, Army Inform reported, citing HUR.

Each recruit Ukraine identifies gives his home government a documented case to act on. Jakarta has said citizens shown to have been deceived will get its protection, while those who enlisted by choice could lose their citizenship.

Justin Pearson is playing a game in which the cards were marked in favor of his opponent after play had already begun. Pearson is the Democratic candidate for Congress in Tennessee’s ninth district (TN-9), one of three in the U.S. South that Republicans rushed to redraw in the wake of a Supreme Court ruling in April that curtailed the Voting Rights Act of 1965. The decision dealt a fatal blow to one of the major gains of the civil rights era. It banned consideration of race when drawing electoral districts, but the court’s conservative majority approved doing so for political reasons.

Seguir leyendo

Russian authorities committed war crimes and crimes against humanity through attacks on Ukraine’s energy infrastructure, the UN Independent International Commission of Inquiry on Ukraine said in a report to the UN General Assembly on 26 October.

International Criminal Court (ICC) warrants for former Russian Defense Minister Sergei Shoigu and Chief of the General Staff Valery Gerasimov, issued in June 2024, already covered alleged crimes linked to Russia’s 2022–2023 strikes on Ukraine’s energy infrastructure. The UN commission’s new report reaches into last winter, 2025–2026, and the cumulative toll since 2022, documenting what the attacks did to civilians living through outages in freezing temperatures.

“As the cold season approaches, the attacks have intensified once again, raising serious concerns about the threats to civilians’ lives and health,” commission chair Erik Møse said.

Russian commanders knew heating facilities were vital

The commission said Russian commanders knew that heating facilities in large cities were indispensable to civilians, particularly during winter. Russian authorities also made official declarations about further attacks and referred to a plan to carry them out, it said. It found that Russian authorities intentionally directed attacks against civilian objects, constituting war crimes.

The commission also concluded that the attacks were carried out under a state policy aimed at depriving civilians of electricity and other essential energy-dependent services and causing suffering. It classified these acts as crimes against humanity in the form of “other inhumane acts.”

Minus 21°C, weeks without heat, and shelters out of reach for older people

Last winter, temperatures fell to minus 21°C as millions of Ukrainians endured prolonged disruptions to heating, electricity, water, and gas, the commission said.

The commission relied on the accounts of 255 people from Dnipropetrovsk, Kyiv, Kharkiv, Kherson, Mykolaiv, Odesa, Poltava, Zaporizhzhia, and Zhytomyr Oblasts, alongside officials, doctors, and nongovernmental organizations.

Older people and those with limited mobility were particularly affected. Fear of becoming trapped in elevators during blackouts prevented some residents from reaching shelters during air raid alerts. They remained in unheated homes, sometimes without access to life-support equipment.

A 53-year-old Kyiv resident told investigators he tried to stay awake at night because he feared he might not wake up if he fell asleep in the cold.

Meanwhile, school closures disrupted children’s education, and children fell ill in unheated homes, the report said.

Russia rejects the findings

Russia’s UN mission said Moscow did not recognize the commission’s mandate and dismissed its findings as “falsified data,” the Associated Press reported.

The commission also examined Ukrainian attacks on energy infrastructure in Russia and Russian-occupied Ukraine. It said it could not investigate their impact fully because Russia denied access and did not respond to its requests.

Foreign recruits trafficked to the front

The same report found “compelling evidence” that Russian authorities trafficked men from 29 countries into the Russian armed forces through deception and coercion.

Recruitment agents arranged visas and travel, presenting themselves as legitimate businesses. After arriving in Russia, the men were forced to sign military contracts in Russian and were sent to the front, where many were killed or went missing, the commission said.

• Cybersecurity experts found severe PHP bugs that could allow attackers to hijack web servers.
• AI is being used to exploit vulnerabilities, making Americans more susceptible to scams.
• Experts stressed basic cyber hygiene and scam awareness, especially for older Americans.

In just two days, AI exposed critical flaws in a programming language behind 70% of all websites. That may have opened the door for a rush of scams — especially those targeted to vulnerable populations like older Americans.

Last week, cybersecurity researchers uncovered two severe bugs in the PHP programming language. Attackers could hijack web servers and execute remote code. This prompted the PHP Foundation to release emergency patches to prevent widespread hacks, and governments, cybersecurity agencies, and businesses quickly moved to do damage control.

Though some experts said there could have been more problems had these flaws not been immediately addressed, such a crisis can happen again. As AI becomes more advanced and widespread, Americans are becoming more exposed and susceptible to scams.

Scams have been pervasive for decades, starting with physical mail and landline telemarketing. But they've gotten significantly more complex and deceptive, now integrating AI in ways that even tech whizzes may not spot. Older Americans are often the main targets of fraud, losing billions in fraud. An AARP survey from April found that 4 in 10 older Americans have lost money to fraud.

With attackers pouncing on any vulnerability to steal personal details or get money, five experts told Business Insider that now is the time to get ahead on scam prevention. Their quotes have been lightly edited for length and clarity.

Craig Newmark, founder of Craigslist, who founded the cybersecurity awareness campaign Take9

What are some of the most common scams targeting older Americans?

Hackers are using AI to ditch the typos and make scams harder to spot. AI also makes it easier to produce large numbers of targeted scams. This includes AI voice cloning and scans of social accounts for personal details. These scams are on the rise and hurting real people, including older folks like me.

How should families react to all the recent headlines about system vulnerabilities?

Don't panic, but don't ignore them either. It shouldn't be up to regular folks to outsmart scammers. The best thing for families to focus on is basic cyber hygiene.

Organizations like Google and Apple are working hard to block scams, particularly on phones. It's just as important that we prepare loved ones with the tools to protect themselves as scammers become more sophisticated.

What are ways in which you work to make people more cautious about scams?

I've been fighting scams for 25 years. I take them personally. That's why I founded Take9 in 2024 to help people understand how to protect themselves and stay safe online.

Scams are overwhelming, and people often don't know where to begin. My advice is to start with the basics: Take 9 seconds to pause before clicking on unknown texts or links.

Once they've got that down, try multi-factor authentication, password managers, passkeys, and single sign-on. Family codes are an effective method to keep your loved ones safe, too.

Don Grant, certified financial planner at Sabre Wealth and CFP Board Ambassador

What are some of the most common scams targeting older Americans?

Scams often involve impersonation of an institution or government agency like the IRS, Medicare, or Social Security. Fake technical support scammers contact you with claims of a breach at your bank or financial institution.

A good friend and client is in his mid-60s, is a single Notre Dame graduate, and is a retired university English professor. He talked incessantly about his gorgeous, accomplished girlfriend. She has sent him photos, but he had never met her in person, nor via video chat.

Fast forward to earlier this year. They are no longer an item. He reluctantly admitted that she was attempting to scam him. He did send her about $1,200 to help get her 9-year-old daughter into a music school. When she hit him up about 10 times so she could move, he figured it out and cut the ties. From what we pieced together, this was an AI-assisted romance scam.

How should families react to all the recent headlines about system vulnerabilities?

A security breach at an institution doesn't automatically mean that your accounts have been hacked. However, it does mean it's time to change your login credentials.

Set up account notifications for withdrawals, transfers, password changes, and anything to do with your accounts. Never respond to an unsolicited email from a site or financial institution with which you do business. Don't call the number provided in the communication or click the provided link. Take the time to log into a verifiable site and call a verifiable number with questions.

What are ways in which you work to make people more cautious about scams?

Communication and education are critical. I have open conversations about financial fraud, anonymously citing actual situations where a scammer attempted to separate them from their money. Recounting others' experiences seems to really drive the point home. We also insist that all clients designate a trusted contact we can reach if we notice unusual activity or have concerns about possible financial exploitation.

Removing the stigma that they are "stupid" if they are scammed is paramount. Many victims are embarrassed to admit they've been deceived, and that embarrassment can prevent them from seeking help.

Alex Jacquez, Groundwork Collaborative's senior vice president of policy, advocacy, and research

What are some of the most common scams targeting older Americans?

The FTC recently released its Protecting Older Consumers report, describing fraud in 2025. The top fraud types by incident report numbers for older people include online shopping, business impostors, government impostors, and investment scams. These, plus romance scams, are the top fraud types by total dollars lost for older people.

Scammers use AI to create deepfakes, clone voices, and send phishing messages. These types of fraud are not new, but AI makes them increasingly convincing and enables them to be carried out on a larger scale. Scammers also use AI in predictive targeting to find the most susceptible individuals.

In March 2026, Interpol warned that "AI-enhanced fraud is 4.5 times more profitable than traditional methods" because AI agents can complete the fraud on behalf of the scammers.

How should families react to all the recent headlines about system vulnerabilities?

Families should see the recent headlines about system vulnerabilities as part of a larger problem. Companies collect lots of information on users and fail to protect it. Now, consumers are exposed to data breaches and sophisticated scams.

What are ways in which you work to make people more cautious about scams?

We put out material for consumers and policymakers highlighting how companies are using more sophisticated techniques and technologies to rip them off.

While there are best practices people can follow to remain alert and vigilant against common scams, especially in the AI age, we believe that any real fix must be systematic and undertaken by policymakers. We need companies to better protect consumer data, stop collecting irrelevant data, and stop using it to squeeze consumers for every last dime.

Amy Nofziger, senior director of victim support, AARP Fraud Watch Network

What are some of the most common scams targeting older Americans?

Impostor scams remain the number one category reported to the AARP Fraud Watch Network Helpline. They will say there is a problem with your account and need to remotely access it, or they will say they are with the courthouse and you missed jury duty and demand payment to avoid being arrested.

AI hasn't changed human nature, but it has changed the scale, speed, and sophistication of scams. Criminals are still exploiting the same emotions they always have: fear, trust, loneliness, hope, curiosity, and urgency. We used to tell people to look for red flags like misspellings and poor grammar in emails, but with today's AI tools, those clues are often gone.

How should families react to all the recent headlines about system vulnerabilities?

It's understandable to be concerned by headlines about system vulnerabilities and data breaches, but the key is to focus on what you can control. The goal isn't to live in fear. It's to stay informed, slow down when something feels off, and ask for help. We don't have to do this alone.

What are ways in which you work to make people more cautious about scams?

AARP Fraud Watch Network helps individuals and families protect themselves from scams. It's a free resource available to everyone. We provide fraud prevention information, online tools, the award-winning Perfect Scam podcast, and a Fraud Watch Network Helpline that receives more than 100,000 calls each year.

Ali Tager, vice president of external affairs, National Cryptocurrency Association

What are some of the most common scams targeting older Americans?

Some of the most common online finance scams are relationship scams and impersonation. Giveaway scams are when scammers impersonate public figures, promising "free" money or crypto if users start by sending a small amount first. In phishing scams, fraudsters pose as a friend or a crypto exchange and ask victims to click links or share login details to steal private information.

Pump and dump scams occur when groups inflate the price of lesser-known crypto coins via online hype. When enough people join and spike the price, fraudsters quickly sell off their holdings for a profit, leaving others in the dust.

How should families react to all the recent headlines about system vulnerabilities?

Stay alert, not alarmed. Whether it's your bank, your Venmo account, or your crypto account, security should always be top of mind. Protecting yourself starts with recognizing common scams and practicing smart online habits.

For crypto holders, guard your private key or recovery phrase like you would your bank account number and password. No legitimate company will ever ask for it, so never share it, and keep physical backups in secure locations. Watch for small clues like odd sender addresses or sloppy spelling, and remember that deepfakes and fake websites can look real at first glance.

What are ways in which you work to make people more cautious about scams?

A scammer's greatest weakness is an informed community. The NCA is dedicated to helping everyday Americans understand and use crypto with confidence. Research shows that 72% of crypto holders cite scams and security as a concern. However, 76% of crypto holders say it has positively impacted their lives overall, while just 3% report negative impacts. Of those, about one-third are scam/fraud-related.

• I followed Bobby Flay's recipe for perfect eggs using crème fraîche.
• I also tried making the recipe with cheaper ingredients like sour cream and Greek yogurt.
• The eggs made with crème fraîche tasted the best, but I'd use sour cream next time.

Scrambled eggs can be a difficult breakfast staple to master, but according to celebrity chef Bobby Flay, you can avoid a rubbery or dry texture by using crème fraîche, a dairy product similar to sour cream.

Since I don't often buy crème fraîche, however, I tried Flay's recipe alongside two two cheaper, similar alternatives — sour cream and Greek yogurt — to see if they would yield similar results. Here's how it went.

First, I made eggs using sour cream

I began with testing out sour cream, which isn't as rich as crème fraîche but offers a similar tangy flavor and texture.

Following the basic steps of Flay's recipe, I put a pat of cold butter and sour cream in a pan. I was careful not to use too much since I wanted enough to moisten the eggs without making them too wet.

Then, I turned the burner to medium-low heat and added two whisked eggs. I constantly stirred the mixture with a rubber spatula, adding black pepper once the eggs began to hold their shape.

I turned the heat off shortly before the eggs looked done to keep the moisture and prevent overcooking, and added the salt. I let the eggs cook for about a minute in the hot pan with the gas burner turned off.

Using sour cream was cost-effective, but the texture wasn't even throughout

The eggs definitely looked smoother than they usually do when I make them, and they smelled buttery and even slightly cheesy.

When I took a bite, they tasted good, too — a little buttery and no tang from the sour cream.

However, despite my constant stirring, I thought they had an uneven texture, as a few bites were slightly rubbery and dry, or a little too wet for my taste.

This ingredient is the cheapest of the three options I tried so, even if the eggs weren't the best, I'd still add a little sour cream if I had it on hand and wanted scrambled eggs.

The Greek yogurt didn't add the same richness as the other ingredients I tested

Next, I followed the same recipe and steps using a similar amount of Greek yogurt, which blended into the eggs seamlessly while cooking.

I knew after the first bite that this ingredient was not a good alternative to Flay's recommended crème fraîche.

The dish looked creamier than the eggs made with sour cream, but the non-fat Greek yogurt created a uniform rubbery texture.

I think one issue is that I accidentally used a yogurt without fat. Because Greek yogurt is so tangy, even more so than sour cream, I think the flavor masked the taste of the butter, salt, and eggs, and resulted in an overall blandness.

The dish also was slightly watery and left a small pool of liquid on my plate.

Finally, I tested Flay's tried-and-true crème fraîche, which pleasantly surprised me

The crème fraîche had the thickest texture of the three, so I expected the eggs to be pretty rich.

I followed the same steps, noticing how effortlessly the crème fraîche melted into the whisked eggs.

This dish with crème fraîche took slightly longer to cook, but the eggs seemed moist and fluffy without looking underdone.

Out of the three recipes, this one resulted in the best flavor and definitely didn't feel undercooked.

When I took a bite, I thought the flavor was amazing. They tasted soft, rich, and buttery and nearly melted in my mouth.

The creamy eggs would work so well with salty, crispy hash browns, roasted veggies, or a really good crusty bread.

The eggs with crème fraîche tasted the best, but I'd use sour cream if I made the recipe again

Though I thought the eggs made with crème fraîche tasted the best, I would use the cheaper alternative, sour cream, if I tried Flay's recipe again.

I don't often have crème fraîche on hand, so it would also be easier to use the sour cream since I usually buy it anyway.

That said, if I wanted a more indulgent version of this breakfast staple, I'd totally add crème fraîche to my grocery list.

This story was originally published on March 5, 2022, and most recently updated on October 26, 2026.

For Emergence Magazine, James Bridle writes about artificial intelligence; carpentry and chair-making with ChatGPT; and Enzo Mari, a famed Italian furniture designer from the 1950s and ’60s. Bridle asks: “What if we used AI for something actually useful?” They offer an interesting take on AI, and why the extractive way we’re using it is far from satisfying.

What we have here is, quite literally, a chair designed by someone who has read a lot about chairs but never actually sat in one. They know what a chair should look like, what it should do, the mechanics of how one is put together, the physics of holding you up. But they have no embodied experience of the world, no history with chairs or any other object, no physical memory. They don’t know how it feels, not merely to sit in a chair, but to encounter one in the world, to place it among other things in a home, to live with it, to be around it every day as one goes about the mundane business of life. This is the idea of a chair brought to life; but things—objects, beings, relationships—are not mere ideas, and you certainly can’t get every aspect of them from books. The chair is low stakes, but, once again, you wouldn’t want to run a society, or a culture, or a planet this way.

Kazakhstan, Kyrgyzstan, and Kenya are seeking the return of citizens drawn into Russia’s war, Ukraine’s Foreign Intelligence Service (SZRU) said on 25 October. According to relatives and officials the agency cites, many of the men had gone to Russia for work, only to be tricked or forced into its army.

Russia fills its ranks partly with foreigners. In April, Ukraine’s military intelligence (HUR) said the Russian Defense Ministry plans to enlist at least 18,500 of them in 2026. Foreign recruits let the Kremlin put off hard choices about another mobilization at home, the Atlantic Council argued in May. Home governments have pushed back before, among them Ghana in August. The new statements show the limit of that pushback. Once a man is serving in Russia’s army, his government has to ask Russia to let him go.

Kyrgyz minister: contracts are forced in enlistment offices and jails

Kyrgyz Foreign Minister Jeenbek Kulubaev addressed the problem at a parliamentary committee on 13 October, answering lawmakers’ questions. He said Kyrgyz citizens in Russia are forced to sign contracts at military enlistment offices or in pretrial detention centers. If warned in time, diplomats try to stop the men from reaching the front.

Kazakhstan is compiling a list for Moscow

Kazakhstan is negotiating with Russia over citizens in the combat zone. Its Foreign Ministry said on 7 October that it was checking each hotline request. Once the checks are complete, the ministry said, it will send the compiled list to the Russian side.

SZRU separately cited unnamed relatives of one Kazakh worker. After he complained about working conditions, they said, he and other men were taken to an enlistment office and forced to sign contracts.

Kenya wants five men held by Ukraine treated as possible trafficking victims

Prime Cabinet Secretary Musalia Mudavadi, who also handles foreign affairs, gave lawmakers a count on 8 October. “The Ministry has records of 354 Kenyan nationals involved in the Russian-Ukraine crisis,” he told them. Families who petitioned Parliament dispute that number and put their own count at 841, Kenya’s The Star reported.

Explore further

Kenya says Russia agreed to stop recruiting its citizens – families of the missing are still waiting

Ukraine holds five Kenyans captured while fighting for Russia, and Nairobi has already appealed to Kyiv over them. The government told Parliament it wants them treated as people who may have been trafficked abroad.

For Kenyans still serving in Russia’s army, the way out runs through Russian officers. Moscow informed Nairobi that unit commanders will consider requests to end military contracts case by case, the same government response said.

• PHP, the open-source computer programming language, had two major vulnerabilities exposed.
• Yonaton Keller woke on Wednesday to panicked messages about the two PHP vulnerabilities.
• He shares three steps you can take to protect your website.

This as-told-to essay is based on a conversation with Yonaton Keller, a 46-year-old product manager at Zafran Security, based in Tel Aviv. His words have been edited for length and clarity.

When I woke up at 6:30 a.m. on Wednesday, I had multiple messages from around 4:45 a.m. alerting me that two vulnerabilities in the PHP programming language had been disclosed.

I immediately understood that this was a very serious situation.

Websites run different versions of PHP, and it's estimated that around 70% of websites worldwide use it. This isn't the first time PHP vulnerabilities have been found, but these ones require essentially no authentication on the attacker's part.

It's a very tricky situation. If it were a year and a half ago, nobody would have really responded to this so urgently. But this might be one of the first major incidents of its kind in this AI era, and the cycle of how attackers operate and how we typically respond is broken.

AI enhances detection and response times, but it also means that any limited-technical person could exploit these vulnerabilities within minutes.

My team was very concerned and had to act fast

I'm based in Israel, so when it was 6:30 a.m., my time, it was the middle of the night in the US. This time gap worked in our team's favor, as we had time to figure out what was going on before our customers woke up.

PHP is an open-source computer programming language used to create websites and web applications. It's such a widely used programming language that we immediately understood that every one of our customers, which includes major corporations and businesses, would likely be affected by this.

With bugs or critical flaws in the infrastructure, like the two that were found in PHP, exploitation is actually quite easy, especially if you use AI agents. That was the first thing we understood: even completely unskilled attackers can use these vulnerabilities to take down sites.

The PHP Foundation said it would disclose the details of the vulnerabilities and release a fix for newer versions of the language around 5 p.m. Israel time. But some details had already been informally disclosed on an online forum. The post was deleted minutes afterward, but screenshots spread around the internet quite quickly in unofficial forums.

So, my team and I dropped everything else and spent all day on Wednesday gathering informal information to see whether we could mitigate the risk of exploitation before an official fix was released.

How to tell if you're at risk

The first step people can take to figure out if they're impacted is to look at their websites and web applications, and try to understand where PHP is involved. You can also assume that most, if not all, of them will use PHP in some way, unless you have very basic HTML-based pages.

The second step would be to look at what vulnerability scanners online are telling you. Tenable, Qualys, and Rapid7 are usually the big three for releasing detection rules and actually detecting the vulnerability. In this case, these vulnerabilities have caused such widespread panic worldwide that they were quick to respond. This is also a way to understand the exact vulnerabilities in your internet-facing assets.

After taking these steps, immediately look online to upgrade your website to the current PHP version. It's quite easy to upgrade that, and it's free. There are some technical steps to do after the fix, so you might need a tech guy to implement them. If you don't update your PHP version, the impact on your business and website can be very, very serious.

Some people are also fully taking their sites offline, and I think that can be the right call if you have evidence that you are being targeted. However, 70% of the internet can't and shouldn't be taken offline just because those sites have some vulnerabilities. It's an emergency step to take if you have evidence of potential exploitation, but it can't be a step taken by everyone.

This was not just about attackers disrupting your website or web application; it was about them taking control of your server, stealing sensitive documents, moving inside your network, and then carrying out malicious operations, such as deploying ransomware or other actions they intended.

The situation has calmed down, but my cybersecurity team is still very concerned

Things have calmed down a bit since Wednesday, but we're still very, very concerned. Patching 70% of worldwide websites doesn't take a minute or two.

Hours after the fix was disclosed by the PHP Foundation, there were already tons of exploitation attempts popping up online. Attackers are getting quicker. I think that in this AI era, when in a matter of minutes, many attackers can attack, you don't have the time you used to.

The whole traditional process of scoping the attack surface, establishing a remediation plan, then calling a guy who's going to be responsible for this remediation plan, et cetera, is broken.

For a long period of time, organizations were investing a lot in what we call post-compromise scenarios. I think the AI era of cybersecurity will involve a lot more security investments in the pre-compromise realm, so defenses can be pre-built and ready for attacks in situations like this.