The Pentagon is treating the spate of mysterious freezer malfunctions that spoiled food at military bases across the United States in August as a suspected hack, according to four officials familiar with the matter.

One of the officials said the military investigators were in touch with their French counterparts about a similar cyberattack on commercial freezers that disrupted supermarkets there earlier this month.

Reuters was not able to ascertain how far along the Pentagon’s investigation was or whether it had reached any conclusions about what happened or who might be responsible. When asked about the investigation, the Pentagon said that a unit of Cyber Command — the military’s cyber force — was “working in close coordination with interagency and law enforcement partners.” It did not elaborate.

The US Army Criminal Investigation Division said its Cyber Field Office was involved in the investigation and that it was working with French law enforcement to better understand “the refrigeration outages in Europe.”

Military investigators examine suspected sabotage

The late August malfunctions in the United States affected at least six commissaries — on-base stores where military personnel buy their food — according to a Reuters review of the military bases’ contemporaneous Facebook posts and website updates. In at least one of the cases, the freezers did not simply stop working; the cooling units’ temperatures were cranked up overnight, yielding mounds of wilted or melted food in the morning.

The Fort Huachuca, Arizona, Facebook account explained on August 26 that its freezer “went into defrost mode where it heated up all the food. Trust us when we say it was ‘spoiled.'”

The spate of rogue freezer behavior and the possibility of cybersabotage were first reported on August 28 by a recently created blog called Signal and Silence. The involvement of military investigators and their contacts with the French were reported by the newspaper Stars and Stripes and Britain’s Daily Telegraph, respectively. The news that the investigators were treating the incident as a suspected hack is being reported here for the first time.

The French Embassy in Washington did not return a message seeking comment.

French cyberattack offers possible clues

If confirmed to be a cyberattack, the refrigerator malfunctions would be another illustration of how vulnerable critical infrastructure — in this case cold storage — can be to hackers.

The French freezer cyberattack overrode the temperature controls on commercial cooling units in more than 350 establishments, leading to dramatic scenes as supermarkets’ frozen food aisles were cleared of spoiled merchandise.

The French hack involved cranking the temperature inside the units up rather than merely knocking them offline, similar to what happened in Fort Huachuca in Arizona. Some French refrigeration units had the temperature turned up so high they caught fire. The French attack’s total costs could add up to tens of millions of euros nationwide, one supermarket owner estimated earlier this month.

Outdated technology leaves refrigeration systems vulnerable

The French cyberattack appeared to have ​been easy to pull off, experts previously told Reuters. The Danish firm Danfoss, whose controllers ran made many of the stricken units, said that many of the controllers were obsolete or were running outdated firmware, which could have made it easy for hackers to break in. Reuters could not establish whether Danfoss or any other brand of freezer controller were in use at the affected US bases. Danfoss did not return messages seeking comment.

Hackers pose growing threat to food supplies

Refrigeration plays a critical role in the distribution of fresh food and the sabotage of cold storage facilities over the internet has long been seen as a nightmare scenario, alongside the loss of electricity or water plants.

Earlier this year, the Global Food Safety Initiative, an industry body, called on food safety professionals and IT leaders to work together to ensure “robust cybersecurity” for refrigeration technology, noting that “a hacked cooling system is just as dangerous as a broken one.”

Hackers have previously sabotaged fridges and freezers both in the United States and elsewhere.

Danfoss has said that, in 2022, hackers either targeted or broke into supermarkets in Russia and Israel that were using obsolete versions of its cold storage controllers. In December of last year, federal prosecutors in Los Angeles accused a Ukrainian woman of being part of a hacker group that knocked out the refrigeration at a meatpacking facility in 2024, ruining more than 2,000 pounds of meat.

The root problem was that controllers that were initially conceived as isolated interfaces that would be serviced by an in-person technician were increasingly being connected to the internet, said Bill Moore, the chief executive of industrial cybersecurity firm Xona Systems. Concerns about online exposure were not unique to cooling systems, he said, but they could have particularly serious consequences there.

“It can definitely disrupt the supply chain for food,” he said.

Cyprus already has a relatively demanding framework for reporting cyber incidents, with a 6-hour early warning deadline and a fuller notification requirement within 72 hours, but the country must ensure its institutions can respond effectively as artificial intelligence accelerates cyber threats, according to a new report by the Digital Cooperation Organisation (DCO).

The findings appear in the organisation’s September 2026 edition of DCO Policy Watch, titled ‘Resilience at Machine Speed: National Cyber Defense in the Age of AI‘, which examines how governments can strengthen their defences against increasingly automated attacks and prepare for the eventual transition to quantum-resistant cryptography.

The report places Cyprus among jurisdictions with a defined incident-reporting interval in force, noting that its Article 35B requirements establish a tighter initial reporting timeframe than the default under the European Union’s NIS2 Directive.

However, it cautions that having a deadline does not automatically mean a country can respond effectively, with the resources, staffing and operational capabilities behind the rules ultimately determining their value.

For Cyprus, the broader lesson is that existing reporting requirements should form part of a comprehensive national strategy that connects early warnings to effective incident response, investment in defensive artificial intelligence and preparation for future cryptographic risks.

The report argues that cyber resilience is not simply a level of protection a government purchases, but the ability to detect an intrusion, contain it, maintain essential services and recover afterwards.

That capacity must be built, staffed and tested before an attack occurs.

The urgency is increasing. CrowdStrike’s observations of financially motivated cybercrime in 2025 found that the average time taken by an intruder to move from an initially compromised machine to a second machine had fallen to 29 minutes, while the fastest observed case took just 27 seconds.

In July 2026, autonomous AI agents operated by OpenAI conducted a four-and-a-half-day campaign that included an intrusion into the production infrastructure of Hugging Face, the largest public repository of open-source AI models.

The agents were given objectives, tools and permission to act across multiple steps without a person directing each individual action, illustrating how attacks can unfold with little or no immediate human intervention.

The report warns that the time available for people to make decisions during an incident is shrinking, making advance preparation increasingly important.

The financial consequences of inadequate preparation are illustrated by Costa Rica, where a ransomware campaign in 2022 prompted a response across 10 institutions that the country’s Comptroller General assessed at roughly 14 times the institutions’ combined cybersecurity spending in the preceding year.

Costa Rica had a national strategy, a designated ministry, a response team and an audit that had identified the ministry that subsequently failed.

What it lacked, according to the report, was sufficient funding, an operational plan and an enforceable reporting obligation.

The DCO identifies three pillars of national cyber resilience that governments, including Cyprus, should prioritise.

The first is establishing the institutional foundations needed to respond to incidents, including a published national strategy, a designated authority, clear reporting requirements and deadlines, and a trained workforce.

The report says these components are complementary rather than interchangeable, warning that a reporting duty has limited value if the receiving team lacks the capacity to act.

Although incident-reporting obligations exist across almost all DCO member states, measurable deadlines are less consistently established.

It recommends that governments attach clearly defined reporting intervals to existing legal obligations, taking account of the severity of incidents and the information reasonably available, while ensuring the receiving institutions have the resources to respond.

Ghana provides one example, requiring incidents to be reported to the relevant sectoral or national team within 24 hours of detection.

The second pillar concerns artificial intelligence and the changing balance between attackers and defenders.

The report distinguishes between human attackers using AI to discover vulnerabilities more quickly, autonomous AI agents acting without continuous human direction, and defensive applications of AI that help security teams identify weaknesses, assess incidents and test systems.

It says public evidence is not yet sufficient to establish whether AI overall favours attackers or defenders, but stresses that offensive tools are becoming more accessible.

A campaign against government systems reported in August 2026 was assembled using open-source agent frameworks, illustrating that sophisticated capabilities are not necessarily restricted to the companies developing the most advanced AI models.

The report therefore recommends stronger basic security controls, greater use of AI for defensive purposes and coordinated governance of advanced AI systems.

It also urges governments to record the degree of automation involved in cyber incidents, rather than relying exclusively on classifications of attack techniques.

Such reporting should allow an incident to be marked as “unknown” when the available evidence cannot establish whether actions were automated or directed by a person.

Singapore’s June 2026 guidance on securing agentic AI provides an example of how governments can identify vulnerabilities in automated workflows and apply appropriate safeguards.

For Cyprus, the findings point to the importance of ensuring that existing cyber security procedures account for attacks involving autonomous systems, while testing whether defensive AI tools can perform useful work under real incident conditions.

The report notes that, during the July 2026 Hugging Face incident, commercial AI models initially used by responders refused much of the forensic work because their safeguards could not distinguish between someone investigating an attack and someone conducting one.

An open-weight model running on the platform’s own hardware subsequently helped responders decode staged payloads, demonstrating the value of testing alternative tools before an emergency arises.

The third pillar is preparing for quantum computing, which could eventually undermine some of the public-key cryptographic systems currently used to protect data and authenticate communications.

The report warns of the “harvest now, decrypt later” risk, in which attackers collect encrypted information today in the expectation that future computing capabilities will allow them to decipher it.

Because replacing vulnerable cryptography across government systems can take years, preparation should begin before quantum computers capable of breaking existing protections become available.

The first step is to establish an inventory of the cryptographic algorithms used to protect information in transit and at rest, as well as those used to verify identities.

The report says this can begin without specialised quantum expertise or new procurement.

It recommends introducing inventory requirements through existing regulatory instruments, updating national cryptographic standards to include quantum-resistant algorithms and amending rules governing public key infrastructure, including electronic signatures and trust services.

Governments should then develop funded migration plans that identify responsible institutions, prioritise systems according to risk and establish testing and completion milestones.

The United States has estimated that migrating prioritised federal systems, excluding national security systems, will cost €6.25 billion ($7.10 billion), illustrating the scale of the investment involved.

The report also highlights how long cryptographic transitions can take, citing 22 years between the publication of the Advanced Encryption Standard and the National Institute of Standards and Technology’s cutoff for applying new protection with Triple DES, and 25 years between the first theoretical attack on SHA-1 and its planned retirement in 2030.

The DCO’s proposed roadmap divides action into three stages, beginning with foundational measures that allow governments to understand their own systems, progressing to operational capabilities, and culminating in advanced capabilities that member states can develop more effectively through cooperation.

Alongside reporting deadlines and cryptographic inventories, it recommends identifying essential services that should receive priority protection, ensuring cyber response teams are staffed around the clock and testing defensive AI tools before they are needed.

The report concludes that much of the initial work involves improving existing laws, procedures and administrative systems rather than developing new technology.

However, sustained funding is still required to maintain specialist teams, train and retain staff and complete cryptographic migration.

For Cyprus, the priority is to build on its existing reporting framework by ensuring that warnings lead to effective action, while starting the long-term work of mapping and upgrading vulnerable cryptographic systems.

The report argues that governments can make substantial progress using authorities and resources they already possess, while regional cooperation can help share the cost of capabilities that would be difficult for individual countries to maintain.

Its central message is that the time available for institutional preparation remains, even as the time available to intervene during an attack continues to shrink.

Restrictions on suppliers, changes in procurement policies and replacement of existing ICT infrastructure affect supply chains.

On Tuesday, SEO Amsterdam Economics reported that a proposed revision of the European Union’s Cybersecurity Act, known as CSA2, could lead to losses ranging from 290 million euros (US$324 million) to 2.2 billion euros (US$2.46 billion dollars) for Dutch businesses in the first year of implementation.

RELATED:

Artificial Intelligence Pioneers Call for International Body to Oversee Cybersecurity Standards

The report, titled The Price of Security and commissioned by the Netherlands China Business Council (NCBC), cautions that the impact could extend beyond businesses directly affected by the restrictions, spreading through supply chains and hitting firms in other sectors of the Dutch economy.

The legislation was proposed by the European Commission at the beginning of this year. The draft introduced “non-technical risks” in the name of cybersecurity and supply chain security.

In particular, the draft would identify “countries posing cybersecurity concerns” and “high-risk suppliers,” and exclude listed countries and suppliers from relevant EU supply chains across 18 sectors, including energy, transport, and information and communications technology.

However, the economic implications of restricting suppliers could be substantial, particularly for businesses that rely on existing information and communications technology infrastructure and have limited short-term alternatives, according to the report.

Companies may also need to modify existing systems, adjust production processes and reorganize supply chains to accommodate replacement products. These changes could generate additional costs beyond the losses estimated in the report.

“Security measures do not exist in an economic vacuum,” NCBC Chairman Jochum Haakma said at a seminar on the report on Monday, adding that restrictions on suppliers, changes in procurement policies and the replacement of existing ICT infrastructure can affect entire supply chains, investment decisions and ultimately the competitiveness of the European economy.

In a letter to parliament on June 19, Dutch Minister of Justice and Security David van Weel said the government was concerned about the European Commission’s proposed power to designate entire countries and suppliers as high-risk, citing potentially far-reaching economic, legal and geopolitical consequences, as well as insufficiently clear and detailed criteria and procedures.

The report notes that restrictions on supplier choice could also yield other adverse consequences, as diminished competitive pressure may result in higher prices, lower quality and reduced innovation.

“Strategic autonomy is an important European ambition, but autonomy should not lead to isolation,” Haakma noted.

teleSUR/ JF

Source: Xinhua

• Cybersecurity experts found severe PHP bugs that could allow attackers to hijack web servers.
• AI is being used to exploit vulnerabilities, making Americans more susceptible to scams.
• Experts stressed basic cyber hygiene and scam awareness, especially for older Americans.

In just two days, AI exposed critical flaws in a programming language behind 70% of all websites. That may have opened the door for a rush of scams — especially those targeted to vulnerable populations like older Americans.

Last week, cybersecurity researchers uncovered two severe bugs in the PHP programming language. Attackers could hijack web servers and execute remote code. This prompted the PHP Foundation to release emergency patches to prevent widespread hacks, and governments, cybersecurity agencies, and businesses quickly moved to do damage control.

Though some experts said there could have been more problems had these flaws not been immediately addressed, such a crisis can happen again. As AI becomes more advanced and widespread, Americans are becoming more exposed and susceptible to scams.

Scams have been pervasive for decades, starting with physical mail and landline telemarketing. But they've gotten significantly more complex and deceptive, now integrating AI in ways that even tech whizzes may not spot. Older Americans are often the main targets of fraud, losing billions in fraud. An AARP survey from April found that 4 in 10 older Americans have lost money to fraud.

With attackers pouncing on any vulnerability to steal personal details or get money, five experts told Business Insider that now is the time to get ahead on scam prevention. Their quotes have been lightly edited for length and clarity.

Craig Newmark, founder of Craigslist, who founded the cybersecurity awareness campaign Take9

What are some of the most common scams targeting older Americans?

Hackers are using AI to ditch the typos and make scams harder to spot. AI also makes it easier to produce large numbers of targeted scams. This includes AI voice cloning and scans of social accounts for personal details. These scams are on the rise and hurting real people, including older folks like me.

How should families react to all the recent headlines about system vulnerabilities?

Don't panic, but don't ignore them either. It shouldn't be up to regular folks to outsmart scammers. The best thing for families to focus on is basic cyber hygiene.

Organizations like Google and Apple are working hard to block scams, particularly on phones. It's just as important that we prepare loved ones with the tools to protect themselves as scammers become more sophisticated.

What are ways in which you work to make people more cautious about scams?

I've been fighting scams for 25 years. I take them personally. That's why I founded Take9 in 2024 to help people understand how to protect themselves and stay safe online.

Scams are overwhelming, and people often don't know where to begin. My advice is to start with the basics: Take 9 seconds to pause before clicking on unknown texts or links.

Once they've got that down, try multi-factor authentication, password managers, passkeys, and single sign-on. Family codes are an effective method to keep your loved ones safe, too.

Don Grant, certified financial planner at Sabre Wealth and CFP Board Ambassador

What are some of the most common scams targeting older Americans?

Scams often involve impersonation of an institution or government agency like the IRS, Medicare, or Social Security. Fake technical support scammers contact you with claims of a breach at your bank or financial institution.

A good friend and client is in his mid-60s, is a single Notre Dame graduate, and is a retired university English professor. He talked incessantly about his gorgeous, accomplished girlfriend. She has sent him photos, but he had never met her in person, nor via video chat.

Fast forward to earlier this year. They are no longer an item. He reluctantly admitted that she was attempting to scam him. He did send her about $1,200 to help get her 9-year-old daughter into a music school. When she hit him up about 10 times so she could move, he figured it out and cut the ties. From what we pieced together, this was an AI-assisted romance scam.

How should families react to all the recent headlines about system vulnerabilities?

A security breach at an institution doesn't automatically mean that your accounts have been hacked. However, it does mean it's time to change your login credentials.

Set up account notifications for withdrawals, transfers, password changes, and anything to do with your accounts. Never respond to an unsolicited email from a site or financial institution with which you do business. Don't call the number provided in the communication or click the provided link. Take the time to log into a verifiable site and call a verifiable number with questions.

What are ways in which you work to make people more cautious about scams?

Communication and education are critical. I have open conversations about financial fraud, anonymously citing actual situations where a scammer attempted to separate them from their money. Recounting others' experiences seems to really drive the point home. We also insist that all clients designate a trusted contact we can reach if we notice unusual activity or have concerns about possible financial exploitation.

Removing the stigma that they are "stupid" if they are scammed is paramount. Many victims are embarrassed to admit they've been deceived, and that embarrassment can prevent them from seeking help.

Alex Jacquez, Groundwork Collaborative's senior vice president of policy, advocacy, and research

What are some of the most common scams targeting older Americans?

The FTC recently released its Protecting Older Consumers report, describing fraud in 2025. The top fraud types by incident report numbers for older people include online shopping, business impostors, government impostors, and investment scams. These, plus romance scams, are the top fraud types by total dollars lost for older people.

Scammers use AI to create deepfakes, clone voices, and send phishing messages. These types of fraud are not new, but AI makes them increasingly convincing and enables them to be carried out on a larger scale. Scammers also use AI in predictive targeting to find the most susceptible individuals.

In March 2026, Interpol warned that "AI-enhanced fraud is 4.5 times more profitable than traditional methods" because AI agents can complete the fraud on behalf of the scammers.

How should families react to all the recent headlines about system vulnerabilities?

Families should see the recent headlines about system vulnerabilities as part of a larger problem. Companies collect lots of information on users and fail to protect it. Now, consumers are exposed to data breaches and sophisticated scams.

What are ways in which you work to make people more cautious about scams?

We put out material for consumers and policymakers highlighting how companies are using more sophisticated techniques and technologies to rip them off.

While there are best practices people can follow to remain alert and vigilant against common scams, especially in the AI age, we believe that any real fix must be systematic and undertaken by policymakers. We need companies to better protect consumer data, stop collecting irrelevant data, and stop using it to squeeze consumers for every last dime.

Amy Nofziger, senior director of victim support, AARP Fraud Watch Network

What are some of the most common scams targeting older Americans?

Impostor scams remain the number one category reported to the AARP Fraud Watch Network Helpline. They will say there is a problem with your account and need to remotely access it, or they will say they are with the courthouse and you missed jury duty and demand payment to avoid being arrested.

AI hasn't changed human nature, but it has changed the scale, speed, and sophistication of scams. Criminals are still exploiting the same emotions they always have: fear, trust, loneliness, hope, curiosity, and urgency. We used to tell people to look for red flags like misspellings and poor grammar in emails, but with today's AI tools, those clues are often gone.

How should families react to all the recent headlines about system vulnerabilities?

It's understandable to be concerned by headlines about system vulnerabilities and data breaches, but the key is to focus on what you can control. The goal isn't to live in fear. It's to stay informed, slow down when something feels off, and ask for help. We don't have to do this alone.

What are ways in which you work to make people more cautious about scams?

AARP Fraud Watch Network helps individuals and families protect themselves from scams. It's a free resource available to everyone. We provide fraud prevention information, online tools, the award-winning Perfect Scam podcast, and a Fraud Watch Network Helpline that receives more than 100,000 calls each year.

Ali Tager, vice president of external affairs, National Cryptocurrency Association

What are some of the most common scams targeting older Americans?

Some of the most common online finance scams are relationship scams and impersonation. Giveaway scams are when scammers impersonate public figures, promising "free" money or crypto if users start by sending a small amount first. In phishing scams, fraudsters pose as a friend or a crypto exchange and ask victims to click links or share login details to steal private information.

Pump and dump scams occur when groups inflate the price of lesser-known crypto coins via online hype. When enough people join and spike the price, fraudsters quickly sell off their holdings for a profit, leaving others in the dust.

How should families react to all the recent headlines about system vulnerabilities?

Stay alert, not alarmed. Whether it's your bank, your Venmo account, or your crypto account, security should always be top of mind. Protecting yourself starts with recognizing common scams and practicing smart online habits.

For crypto holders, guard your private key or recovery phrase like you would your bank account number and password. No legitimate company will ever ask for it, so never share it, and keep physical backups in secure locations. Watch for small clues like odd sender addresses or sloppy spelling, and remember that deepfakes and fake websites can look real at first glance.

What are ways in which you work to make people more cautious about scams?

A scammer's greatest weakness is an informed community. The NCA is dedicated to helping everyday Americans understand and use crypto with confidence. Research shows that 72% of crypto holders cite scams and security as a concern. However, 76% of crypto holders say it has positively impacted their lives overall, while just 3% report negative impacts. Of those, about one-third are scam/fraud-related.

Journalists from 17 European public service broadcasters, coordinated by the European Broadcasting Union’s (EBU) Eurovision News Spotlight network, published an interactive map on 23 October 2026. It documents hybrid incidents linked to Russia across 17 European countries between 1 April and 15 October. Journalists compiled a database of hundreds of reported incidents, categorizing each by type and the source and strength of its alleged links to Russia, then verifying them through open-source research.

The map comes as officials warn the campaign is growing. On 28 September, EU foreign policy chief Kaja Kallas said in Brussels that Russia was planning more acts of sabotage to divide societies and intimidate them into abandoning their support for Ukraine. The points on the map represent an incomplete list of publicly known cases attributed to Russia or suspected of being linked to it, the report states.

The map covers airspace violations, sabotage attempts, “disposable” agents with no formal intelligence training, migration used as a weapon, and Russian military activity near or across European borders. It excludes cyberattacks, influence operations, and espionage by trained intelligence officers.

The EBU calls the result a very conservative estimate, not an official tally. Russia has consistently denied responsibility for the incidents. Many single points represent several incidents of the same type in one area or in quick succession. In Moldova, for example, Defense Minister Anatolie Nosatîi said on 30 September that the government had recorded 84 drone incursions.

Four German incidents are on the map, out of many more

The map shows four incidents in Germany, according to BR.

• On 2 August, German authorities arrested a 33-year-old Ukrainian man in Thuringia on suspicion of photographing a Bavarian weapons manufacturer for a foreign intelligence service as part of an alleged sabotage plot.
• On 4 August, a drone carrying explosives and a detonator struck the wing of a Ukrainian An-124 cargo plane at Leipzig/Halle Airport but failed to explode.
• On 3 September, attackers threw firebombs from a car onto a construction site next to defense firms in Munich, and German security authorities suspect Russian intelligence.
• On 14 September, investigators learned of a crashed drone found near the Bundeswehr’s Wunstorf air base.

Internal papers from the new Joint Hybrid Defense Center, seen by Correctiv, record 163 suspected sabotage cases in 2026 up to 19 August. The targets included rail lines, military facilities, substations, and radio masts. The same papers record 1,034 drone overflights of critical infrastructure, military sites, and defense companies, and 25 espionage investigations. The papers cover possible attacks by Russia, China, and Iran, and media did not report a breakdown of the sabotage cases by country.

European leaders sound the alarm over Russian hybrid attacks

On 15 April, Swedish civil defense minister Carl-Oskar Bohlin said pro-Russian groups had moved from denial-of-service attacks to attempts at destructive cyberattacks, including one on a Swedish power plant in 2025. On 1 September, German Foreign Minister Johann Wadephul named Russia as the perpetrator of the Leipzig attack and accused Moscow of “blatant hostility” toward Germany.

On 18 September, French President Emmanuel Macron said Russia’s hybrid attacks would not go unanswered and ordered a plan to protect France’s critical infrastructure. On 1 October, German Chancellor Friedrich Merz said Germany was preparing for new hybrid attacks, “including serious ones.” NATO Secretary General Mark Rutte on 14 October called the attacks a sign of Russian weakness at a press conference in Tallinn and said NATO would react where needed without being “rattled.”

A delegation from the European Parliament has begun a three-day mission to Bosnia and Herzegovina to examine foreign interference in the country’s political institutions, electoral processes and public information environment.

The visit, taking place from 26th to 28th October, comes three weeks after parliamentary elections exposed persistent divisions over Bosnia’s political direction and its prospects of joining the European Union.

The mission is being conducted by Parliament’s Special Committee on the European Democracy Shield, chaired by French MEP Nathalie Loiseau. Its purpose is to assess vulnerabilities to disinformation, cyberattacks, economic pressure and other forms of hybrid interference, and to identify measures that could strengthen Bosnia’s institutional resilience.

According to the European Parliament’s announcement, the delegation will meet government officials, parliamentary representatives, civil society organisations, journalists and researchers. Joining Loiseau are Finnish MEP Mika Aaltola, Portugal’s Ana Catarina Mendes and Romania’s Cristian Terheş.

The investigation comes at a politically sensitive moment. Bosnia’s general election on 4th October confirmed the persistence of competing political priorities between the country’s constituent entities, with pro-Russian politician Milorad Dodik’s Alliance of Independent Social Democrats retaining considerable support in Republika Srpska.

As EU Today reported following the election, parties favouring closer European integration also performed strongly, particularly in the Bosniak-Croat Federation. The resulting political balance will influence the formation of new administrations and their ability to implement reforms demanded by Brussels.

From electoral interference to institutional security

The European Parliament’s investigation extends beyond conventional disinformation campaigns.

MEPs intend to examine how foreign actors may exploit weaknesses in electoral administration, cybersecurity, political financing and the country’s wider economic relationships. They will also consider the role of digital platforms in distributing manipulated information and the legislative gaps that could make interference difficult to identify or prosecute.

The distinction matters in Bosnia, where political influence cannot be separated from the country’s complicated constitutional arrangements.

Under the Dayton peace settlement, the state operates through institutions that distribute authority between the Federation of Bosnia and Herzegovina, Republika Srpska and the central government. Political disagreements can therefore obstruct decisions requiring cooperation between different levels of administration.

External actors seeking influence may exploit those divisions, although identifying a political relationship with a foreign government is not, by itself, evidence of unlawful interference.

The European Union has repeatedly expressed concern about Russia’s activities in the Western Balkans, particularly its relationships with political forces opposing closer integration with European institutions. Chinese investment and economic relationships also raise questions about strategic dependence, although legitimate commercial activity must be distinguished from coercion or covert political operations.

The delegation’s task is to establish which vulnerabilities can be substantiated and whether existing safeguards are adequate.

Accession negotiations remain incomplete

Bosnia received EU candidate status in December 2022. In March 2024, European leaders agreed in principle to open accession negotiations, but progress has remained conditional on institutional and legal reforms.

Following the October election, EU foreign policy chief Kaja Kallas and Enlargement Commissioner Marta Kos issued a joint statement calling for the prompt formation of new administrations and progress on judicial reform.

The Commission also highlighted shortcomings identified by international election observers, including technical difficulties, complicated voting procedures and concerns about ballot secrecy.

Those findings do not automatically establish foreign interference. They do, however, demonstrate why the integrity of electoral institutions remains central to Bosnia’s relationship with Brussels.

A test for the European Democracy Shield

The Sarajevo mission follows the EU’s decision on 13th October to include enlargement partners in the European Centre for Democratic Resilience.

The initiative is intended to improve cooperation on election security, information manipulation, crisis management and institutional protection before candidate countries enter the Union.

EU Today has previously examined the European Democracy Shield’s proposed mechanisms, including closer coordination with technology companies and improved systems for identifying foreign information operations.

Bosnia now offers a practical opportunity to examine whether those instruments can operate effectively in a country where political authority is fragmented and accession remains incomplete.

The delegation’s findings could inform recommendations on institutional cooperation, election safeguards and support for independent media. Any substantial improvement, however, will depend on the willingness of Bosnia’s authorities to implement reforms and enforce existing legislation.

For Brussels, the immediate issue is whether its emerging framework for democratic resilience can provide practical protection to candidate countries while respecting their political sovereignty and the freedoms it is intended to defend.

• All hell broke loose this week after a security flaw in 70% of the world's websites was made public.
• It was supposed to be kept under wraps as a fix was deployed, but one researcher jumped the gun.
• Chainguard CEO Dan Lorenc told POLITICO why he decided to go public.

The exposure was immense, with AI multiplying the risks — and yet time-tested global cybersecurity procedures appeared to be functioning. Then suddenly, it all broke down.

The decision by a cybersecurity company on Wednesday to prematurely release information about a flaw in the popular PHP computer programming language left much of the web exposed to hackers, triggering a panic that brought to life months of warnings of how the AI-powered era could cause widespread damage.

The flaws in PHP, discovered using AI tools through a monthslong process coordinated by OpenAI, caused cyber agencies across Europe, the US, the UK, Australia and Canada to post urgent warnings Wednesday. Numerous governments took websites offline as a precaution.

While no major hacking damage was immediately apparent, the way the incident unfolded over 72 hours showed how easily cybersecurity processes can break down and the outsized consequences of cyber risks in the AI era.

The man who set off the chain reaction with the early release — Chainguard's CEO Dan Lorenc — quickly apologized in a LinkedIn post. But on Thursday, in an interview with POLITICO, Lorenc said he'd shared the information ahead of time because the flaw was already being exploited. Though others disputed that, Lorenc said he believed he'd seen enough evidence to invalidate an embargo set up to allow time to find a fix for the flaws.

While he disputed that his actions would have caused problems for other defenders, Lorenc said that the evidential threshold in these coordinated cyber defense systems is a "grey area."

The revelation of the PHP flaw brings out into the open what cyber officials have been bracing for since the arrival of the most powerful tools of artificial intelligence, which not only can be used to discover vulnerabilities but also to exploit them at scale.

The cybersecurity world's long-established protocols helped prevent disaster scenarios in which hackers would have successfully exploited the vulnerabilities to take control of numerous websites and access their data. But the scale and end-of-days potential of AI-driven cyber risks are now visible for the world to see.

This "is what happens when AI turns up a flaw that's been hiding for years," said Eylam Milner, cofounder and chief technology officer at cybersecurity startup Echo. The vulnerabilities, he added, are "about as serious as it gets for the web."

Origin story

Understanding how this week's emergency unfolded offers a glimpse at how companies and authorities are working to stave off attacks — and how much risk they face going forward.

The origins of the incident can be traced back as far as April, when leading frontier AI firm Anthropic unveiled Mythos, leading some in the cybersecurity world to worry that systems would quickly be overrun by advanced artificial intelligence, with potential for catastrophic events to ensue.

But while researchers did find more flaws in computer systems in the months after Anthropic and other AI firms like OpenAI released those models, they had little impact in the real world. Even the Hugging Face incident, a widely discussed hack that saw OpenAI's autonomous AI agents go rogue during an internal security evaluation, related more to the level of control AI companies exert over their models than their power to break into systems worldwide.

That changed this week after researchers unveiled the vulnerability in PHP, a coding language estimated to be integrated into some 70% of the web.

The process by which information about flaws is released among cybersecurity officials and affiliated companies is crucial. Through a long-standing practice known as coordinated disclosure, researchers and companies that identify flaws can find a fix and share it confidentially with agencies and others before releasing it to the public, meaning they don't hand malicious hackers the gift of a hole without a fix.

In the case of the PHP flaw, that process worked well, but not perfectly. Information about the bugs started to circulate ahead of the planned release time. Then, according to the PHP Foundation, Chainguard "unilaterally broke the embargo," which "disregarded weeks of work by many parties toward a coordinated disclosure." PHP Foundation executive director Elizabeth Barron told POLITICO by email that while it was "disappointed" with Chainguard, it hopes to "rebuild trust with them in the future to ensure we can continue to collaborate effectively."

After the leak — which meant information about the bugs was in the open before the fix was ready — confusion quickly ensued, with government bodies and private companies choosing to temporarily shut down their websites rather than risk potentially damaging breaches to their data and the sites themselves.

Early Thursday, Matthew Prince, the CEO of Cloudflare, an internet services company widely used by websites to block cyberattacks, which gives it a high level of visibility into what hackers are doing, said in a post on X that it had seen "millions" of attempts to exploit the flaw.

Cloudflare saw thousands in the 10 hours before the flaw was publicly announced, then tens of thousands in the 45 minutes after the announcement, hundreds of thousands within two hours, and now millions, Prince said.

Amazon's cloud division also said the flaw is "now being broadly exploited in the wild."

One senior US government cyber official said that federal authorities have been overwhelmed — and not just by PHP. The same day the world was racing to address PHP, they were also dealing with bugs in node.js, a widely used JavaScript framework, Fortinet, GitHub and Oracle.

"The fire department is fighting multiple fires at once," the official said, adding: "The good news is they're all one-story structures on fire, which the fire department deals with all day, every day."

More to come

Dauntingly, OpenAI said there's more on the way. "These bugs are among several significant vulnerabilities we've already found and are working to fix, and we expect similar findings to increase sharply in the coming months," the company said Wednesday in a statement.

Matthijs van Amelsfort, head of the Dutch cybersecurity agency, said in an interview that the job of keeping computer systems safe has been transformed by the advancement of AI. "As soon as the frontier models came out, that's exactly what we said: This will be the trend," he said. "And actually that's happening now."

Thomas Caspers, vice president of Germany's cyber agency BSI, concurred: "We expect that [to be] happening more and more during the coming months."

AI also ramps up the risks once the flaws are out in the open. Cyber agencies' recommendation that organizations take their websites offline was "really a drastic measure," Caspers said. "We wouldn't have done that a few years ago or so." But because AI has made it quicker and easier to exploit flaws, "we had to do that," he said.

At the same time, the use of advanced AI to detect the flaws may create a new level of protection against malicious hackers looking to take advantage of them. Caspers said that though his German agency has also seen attacks, it has not seen any successful use of the flaw by hackers.

"It seems a little bit more complicated than expected to exploit," he said.

Despite the fact that AI offers a new way to discover flaws, the work involved in keeping systems protected is more quotidian, with cyber agencies urging organizations to install the fix shared by the PHP Foundation, in a process known as patching.

"There are three things that you have to do right now," said van Amelsfort from the Dutch agency. "And that's patch, patch, and patch."

John Sakellariadis contributed to this report.

The Axel Springer Global Reporters Network harnesses the resources of the company's newsrooms to publish ambitious scoops, investigations, interviews, opinion pieces and analysis. It allows journalists — including those from POLITICO, The Telegraph, Business Insider, WELT, BILD, Onet and Fakt — to collaborate on major stories for an international audience of hundreds of millions across platforms: online, print, TV and audio.

• Jen Eaves' mother is 79 and lost more than $3,000 to online scams.
• Eaves now monitors her mother's finances and says that was a hard conversation.
• Digital caregiving is an important part of supporting aging parents, she says.

This as-told-to essay is based on a conversation with Jen Eaves, Digital Caregiving & Elder Fraud Advocate at Aura. It has been edited for length and clarity.

It's an odd shift in dynamic when you start caring for the people who always cared for you. My mother is 79, and lives with my brother, who handles most of her day-to-day physical care. I'm the one who handles the administrative side of care, like scheduling doctor appointments and keeping her safe online.

About six years ago, my mom had a stroke, and while she recovered fairly well, she wasn't the same cognitively as she had been before. Around that time, I began noticing her falling for scams online.

Once, she ordered a cure for diabetes, which she has. The product was supposedly being sold by a famous TV doctor. When she showed me the video ad, I could see it was badly done AI, with the supposed doctor's lips not matching his words.

There have been other scams and pitfalls, too: online orders that never arrive, or even a legitimate credit card that my mom opened without realizing what she was doing. All in all, she's lost about $3,000 to scams, though I've been able to recover most of it through her bank.

I've realized that I need to take a more proactive approach to digital caregiving to protect my mom's finances. Here's what I'm doing.

Approaching from a place of help and dignity

After my brother and I had taken my mom's keys away, her phone became her connection to the world. I wanted to respect that. While some people have to restrict their older parents' access to phones, that didn't feel right in my case.

It was critical to me that my mom kept her dignity and as much independence as possible. At the same time, I saw there was an emotional side to falling for a scam: she would feel frustrated and confused when it happened, and I wanted to spare her those negative emotions.

I never want my mom to feel like I'm parenting her. Instead, I pointed out the patterns I was seeing and emphasized I'm here to help if she's willing to let me be involved. The choice, ultimately, is hers. This would be a lot harder if she wasn't willing.

Talk about scams

My mom wasn't particularly tech savvy, even before her stroke. I've had to educate her about what scams look like. When she shared the famous doctor video, I pointed out the aspects that seemed AI-generated to me. I remind her that if it sounds too good to be true, it probably is. I emphasize that urgency is a big sign of a scam. The bank, I tell her, is never going to call you.

Once, she had a scam caller claiming to be Apple support. They asked for her Apple ID and password, which would have given them access to pretty much everything she has online.

Because of our conversations, my mom hesitated. She patched me into the call and asked the scammer to explain the situation to me. I was very proud that she recognized the scam and knew to ask me for help.

I monitor my mom's accounts

I worked in cybersecurity at Aura, which offers a lot of great products for keeping kids safe online. But my experience with my mom made me realize we were missing a whole vulnerable population: older adults.

I helped develop Trusted Family Access, which allows family members like me to see alerts from their loved ones' accounts, with permission. This gives me peace of mind that I can catch any issues quickly. It's also made other aspects of caregiving easier, like handling medical appointments, because I have access to all my mom's information in one place.

When my mom was scammed, it felt like I was a victim too. I spent hours calling her bank and credit cards to get her money back. If she were to lose her savings, it would impact the whole family. I'm grateful we've found a solution that empowers both of us to keep her finances safe.

• Everyone complains about AI-generated junk.
• But decades of sloppy human-written software may be a much bigger problem.
• This week's "Black October" freakout was caused by human slop, not AI.

The internet has a slop problem. And for once, we can't blame AI.

Most of us spend hours online every day without thinking much about the software holding everything together. We assume somebody, somewhere, has made sure it all works properly.

So it probably came as a shock this week to discover just how vulnerable some of that software is.

The cybersecurity freakout dubbed "Black October" has inspired warnings about AI-powered hackers, digital catastrophe, and even advice to stockpile cash and canned food.

At first glance, AI looks like the villain. But this is largely a human-made mess.

Here's the problem.

The internet runs on decades of software, some of it containing security weaknesses that have been overlooked, tolerated, or simply left unfixed.

For years, that was a manageable gamble. Fixing software takes time and money. Exploiting obscure weaknesses often required considerable expertise. Companies could convince themselves that the risk wasn't worth worrying about.

AI is changing that calculation. Someone who once needed years of training to hunt for weaknesses can now get help from an AI model. These tools can also examine software at speeds that humans can't match.

Suddenly, all those problems we've been ignoring look more urgent.

"Over the last 10 years the risk acceptance process has morphed from a way to accept risks to enable the business, to a way to justify never fixing security issues," Joel de la Garza and Zane Lackey, partners at a16z, wrote on Friday.

That's quite an indictment. The result is a recent surge in published vulnerabilities.

This looks like AI is creating new security problems. But it's actually AI exposing weaknesses that humans left behind.

Slop irony

The irony is delicious. We've spent the past couple of years complaining about "AI slop." Turns out human slop can be pretty consequential, too.

"The funny thing is everyone was saying AI slop code will cause a cyber crisis but it's actually all the old human slop causing it and the AI is just cleaning it up," software engineer Ben Kaufman wrote on X on Thursday.

"Humans have been the ones writing and reviewing each other's code for decades," tech founder Anant Jain wrote on X. "If we're being intellectually honest and holding ourselves to the same bar we hold AI to, we'd have to admit that we haven't been all that good at it either."

Humans are sloppy

Anyone who's worked with other humans for a decade or two knows exactly how this happens.

It's Friday afternoon. You've almost finished a project. You could spend another few hours making it perfect, or declare it 90% done and head off to that dinner party. We've all been there.

AI agents don't have dinner parties. They don't get tired on Friday afternoons. They can keep searching, testing, and trying again. That persistence is now colliding with an internet built by busy, imperfect humans who often settled for "good enough for now."

A tragedy of the commons

There's another wrinkle here, though, and it's an important one.

Much of the software underpinning the internet is freely available for anyone to use. Some of it is maintained by volunteers or small groups of experts, even as enormous technology companies depend on it.

In 2020, the cartoonist Randall Munroe captured this absurdity in an xkcd comic. Modern digital infrastructure still rests precariously on tiny foundations.

It's funny because it's uncomfortably close to reality. Take the specific PHP problems from this week. These flaws have existed for years, and the PHP Foundation acknowledges that limited resources and disagreements over fixes contributed to delays in fixing them.

Tom Occhino, chief product officer at Vercel, brought up Munroe's cartoon during my recent interview with him.

He explained that AI is finding weaknesses even in software that the industry has treated as dependable for decades.

This is partly a version of the tragedy of the commons: Everyone benefits from a shared resource, but no one has sufficient incentive to take responsibility for maintaining it.

And let's be clear: The volunteers keeping essential software running aren't the villains here. The companies benefiting from their work have a much greater responsibility.

Occhino thinks AI could help solve the problem it is exposing.

He described an idea being discussed at Vercel: Create a foundation or coalition that funds efforts to identify vulnerable software and replace it with safer alternatives.

"We need a consortium. We need a coalition," he told me.

He suggested companies could contribute computing resources and AI tools to the effort. Nothing has been formally announced, but the idea is compelling.

Indeed, OpenAI's Patch the Planet effort is an example of what's possible.

Rather than simply using AI to create more software, the industry could use it to repair what already exists.

Occhino put it nicely: Companies need to spend less time chasing new ideas and more time asking how to make existing systems "just work really, really well."

That's a better response than panicking about the imminent collapse of the internet.

AI didn't create decades of neglected software. We did. Perhaps it's time to clean up our own slop.

Sign up for the AI Insider newsletter here. Reach out to me via email at abarr@businessinsider.com

• Mark Cuban compared swarms of AI agents to cockroaches finding ways into systems.
• Cuban said agents can launch brute-force attacks at scale without inventing new hacks.
• Cuban said defenders can also "spray" their systems with AI, which makes defenses more accessible.

Mark Cuban has pest-control tips for the AI age.

Speaking at a Reuters NEXT Newsmaker event on Friday, the entrepreneur and billionaire investor compared the threat posed by swarms of AI agents to cockroaches finding their way into a freshly treated house.

"When I go talk to cybersecurity experts, I ask them all the time. I'm like, when we hear about these hacks and breakthroughs and, you know, different problems, do these AIs invent something new?" Cuban said.

"No, they didn't invent something new," Cuban added. "But they're able to do something in mass volume that it's all brute force hacks."

Cuban compared the challenge to keeping cockroaches out of a house.

"It's like the cockroach theory, where if somebody can create enough agents, it'll find a way to get in, and then it just exploits that. But the good news is you can spray your systems with just as much AI, and I think there's gonna be more effort from the good guys trying to stop the bad guys," Cuban said. "I'm not a doomer at all."

The AI industry is already creating its own team of exterminators to contain risks.

OpenAI safety roles on LinkedIn jumped by 91% over the past year, spanning work such as system testing, technical research, and governance.

The risks have also surfaced during testing. Anthropic said that three Claude models accessed organizations’ live systems without permission after a third-party testing environment was misconfigured. The company subsequently introduced real-time classifiers to detect and block attempts to escape testing environments.

Cuban said AI could make malicious activity more accessible, but the same techniques could also strengthen defenses.

"There will be scenarios where bad stuff happens, but we've always had hacks," said Cuban. "And if it's brute force on that side with the bad guys, you can also use brute force with the good guys."

• PHP, the open-source computer programming language, had two major vulnerabilities exposed.
• Yonaton Keller woke on Wednesday to panicked messages about the two PHP vulnerabilities.
• He shares three steps you can take to protect your website.

This as-told-to essay is based on a conversation with Yonaton Keller, a 46-year-old product manager at Zafran Security, based in Tel Aviv. His words have been edited for length and clarity.

When I woke up at 6:30 a.m. on Wednesday, I had multiple messages from around 4:45 a.m. alerting me that two vulnerabilities in the PHP programming language had been disclosed.

I immediately understood that this was a very serious situation.

Websites run different versions of PHP, and it's estimated that around 70% of websites worldwide use it. This isn't the first time PHP vulnerabilities have been found, but these ones require essentially no authentication on the attacker's part.

It's a very tricky situation. If it were a year and a half ago, nobody would have really responded to this so urgently. But this might be one of the first major incidents of its kind in this AI era, and the cycle of how attackers operate and how we typically respond is broken.

AI enhances detection and response times, but it also means that any limited-technical person could exploit these vulnerabilities within minutes.

My team was very concerned and had to act fast

I'm based in Israel, so when it was 6:30 a.m., my time, it was the middle of the night in the US. This time gap worked in our team's favor, as we had time to figure out what was going on before our customers woke up.

PHP is an open-source computer programming language used to create websites and web applications. It's such a widely used programming language that we immediately understood that every one of our customers, which includes major corporations and businesses, would likely be affected by this.

With bugs or critical flaws in the infrastructure, like the two that were found in PHP, exploitation is actually quite easy, especially if you use AI agents. That was the first thing we understood: even completely unskilled attackers can use these vulnerabilities to take down sites.

The PHP Foundation said it would disclose the details of the vulnerabilities and release a fix for newer versions of the language around 5 p.m. Israel time. But some details had already been informally disclosed on an online forum. The post was deleted minutes afterward, but screenshots spread around the internet quite quickly in unofficial forums.

So, my team and I dropped everything else and spent all day on Wednesday gathering informal information to see whether we could mitigate the risk of exploitation before an official fix was released.

How to tell if you're at risk

The first step people can take to figure out if they're impacted is to look at their websites and web applications, and try to understand where PHP is involved. You can also assume that most, if not all, of them will use PHP in some way, unless you have very basic HTML-based pages.

The second step would be to look at what vulnerability scanners online are telling you. Tenable, Qualys, and Rapid7 are usually the big three for releasing detection rules and actually detecting the vulnerability. In this case, these vulnerabilities have caused such widespread panic worldwide that they were quick to respond. This is also a way to understand the exact vulnerabilities in your internet-facing assets.

After taking these steps, immediately look online to upgrade your website to the current PHP version. It's quite easy to upgrade that, and it's free. There are some technical steps to do after the fix, so you might need a tech guy to implement them. If you don't update your PHP version, the impact on your business and website can be very, very serious.

Some people are also fully taking their sites offline, and I think that can be the right call if you have evidence that you are being targeted. However, 70% of the internet can't and shouldn't be taken offline just because those sites have some vulnerabilities. It's an emergency step to take if you have evidence of potential exploitation, but it can't be a step taken by everyone.

This was not just about attackers disrupting your website or web application; it was about them taking control of your server, stealing sensitive documents, moving inside your network, and then carrying out malicious operations, such as deploying ransomware or other actions they intended.

The situation has calmed down, but my cybersecurity team is still very concerned

Things have calmed down a bit since Wednesday, but we're still very, very concerned. Patching 70% of worldwide websites doesn't take a minute or two.

Hours after the fix was disclosed by the PHP Foundation, there were already tons of exploitation attempts popping up online. Attackers are getting quicker. I think that in this AI era, when in a matter of minutes, many attackers can attack, you don't have the time you used to.

The whole traditional process of scoping the attack surface, establishing a remediation plan, then calling a guy who's going to be responsible for this remediation plan, et cetera, is broken.

For a long period of time, organizations were investing a lot in what we call post-compromise scenarios. I think the AI era of cybersecurity will involve a lot more security investments in the pre-compromise realm, so defenses can be pre-built and ready for attacks in situations like this.