• All hell broke loose this week after a security flaw in 70% of the world's websites was made public.
• It was supposed to be kept under wraps as a fix was deployed, but one researcher jumped the gun.
• Chainguard CEO Dan Lorenc told POLITICO why he decided to go public.

The exposure was immense, with AI multiplying the risks — and yet time-tested global cybersecurity procedures appeared to be functioning. Then suddenly, it all broke down.

The decision by a cybersecurity company on Wednesday to prematurely release information about a flaw in the popular PHP computer programming language left much of the web exposed to hackers, triggering a panic that brought to life months of warnings of how the AI-powered era could cause widespread damage.

The flaws in PHP, discovered using AI tools through a monthslong process coordinated by OpenAI, caused cyber agencies across Europe, the US, the UK, Australia and Canada to post urgent warnings Wednesday. Numerous governments took websites offline as a precaution.

While no major hacking damage was immediately apparent, the way the incident unfolded over 72 hours showed how easily cybersecurity processes can break down and the outsized consequences of cyber risks in the AI era.

The man who set off the chain reaction with the early release — Chainguard's CEO Dan Lorenc — quickly apologized in a LinkedIn post. But on Thursday, in an interview with POLITICO, Lorenc said he'd shared the information ahead of time because the flaw was already being exploited. Though others disputed that, Lorenc said he believed he'd seen enough evidence to invalidate an embargo set up to allow time to find a fix for the flaws.

While he disputed that his actions would have caused problems for other defenders, Lorenc said that the evidential threshold in these coordinated cyber defense systems is a "grey area."

The revelation of the PHP flaw brings out into the open what cyber officials have been bracing for since the arrival of the most powerful tools of artificial intelligence, which not only can be used to discover vulnerabilities but also to exploit them at scale.

The cybersecurity world's long-established protocols helped prevent disaster scenarios in which hackers would have successfully exploited the vulnerabilities to take control of numerous websites and access their data. But the scale and end-of-days potential of AI-driven cyber risks are now visible for the world to see.

This "is what happens when AI turns up a flaw that's been hiding for years," said Eylam Milner, cofounder and chief technology officer at cybersecurity startup Echo. The vulnerabilities, he added, are "about as serious as it gets for the web."

Origin story

Understanding how this week's emergency unfolded offers a glimpse at how companies and authorities are working to stave off attacks — and how much risk they face going forward.

The origins of the incident can be traced back as far as April, when leading frontier AI firm Anthropic unveiled Mythos, leading some in the cybersecurity world to worry that systems would quickly be overrun by advanced artificial intelligence, with potential for catastrophic events to ensue.

But while researchers did find more flaws in computer systems in the months after Anthropic and other AI firms like OpenAI released those models, they had little impact in the real world. Even the Hugging Face incident, a widely discussed hack that saw OpenAI's autonomous AI agents go rogue during an internal security evaluation, related more to the level of control AI companies exert over their models than their power to break into systems worldwide.

That changed this week after researchers unveiled the vulnerability in PHP, a coding language estimated to be integrated into some 70% of the web.

The process by which information about flaws is released among cybersecurity officials and affiliated companies is crucial. Through a long-standing practice known as coordinated disclosure, researchers and companies that identify flaws can find a fix and share it confidentially with agencies and others before releasing it to the public, meaning they don't hand malicious hackers the gift of a hole without a fix.

In the case of the PHP flaw, that process worked well, but not perfectly. Information about the bugs started to circulate ahead of the planned release time. Then, according to the PHP Foundation, Chainguard "unilaterally broke the embargo," which "disregarded weeks of work by many parties toward a coordinated disclosure." PHP Foundation executive director Elizabeth Barron told POLITICO by email that while it was "disappointed" with Chainguard, it hopes to "rebuild trust with them in the future to ensure we can continue to collaborate effectively."

After the leak — which meant information about the bugs was in the open before the fix was ready — confusion quickly ensued, with government bodies and private companies choosing to temporarily shut down their websites rather than risk potentially damaging breaches to their data and the sites themselves.

Early Thursday, Matthew Prince, the CEO of Cloudflare, an internet services company widely used by websites to block cyberattacks, which gives it a high level of visibility into what hackers are doing, said in a post on X that it had seen "millions" of attempts to exploit the flaw.

Cloudflare saw thousands in the 10 hours before the flaw was publicly announced, then tens of thousands in the 45 minutes after the announcement, hundreds of thousands within two hours, and now millions, Prince said.

Amazon's cloud division also said the flaw is "now being broadly exploited in the wild."

One senior US government cyber official said that federal authorities have been overwhelmed — and not just by PHP. The same day the world was racing to address PHP, they were also dealing with bugs in node.js, a widely used JavaScript framework, Fortinet, GitHub and Oracle.

"The fire department is fighting multiple fires at once," the official said, adding: "The good news is they're all one-story structures on fire, which the fire department deals with all day, every day."

More to come

Dauntingly, OpenAI said there's more on the way. "These bugs are among several significant vulnerabilities we've already found and are working to fix, and we expect similar findings to increase sharply in the coming months," the company said Wednesday in a statement.

Matthijs van Amelsfort, head of the Dutch cybersecurity agency, said in an interview that the job of keeping computer systems safe has been transformed by the advancement of AI. "As soon as the frontier models came out, that's exactly what we said: This will be the trend," he said. "And actually that's happening now."

Thomas Caspers, vice president of Germany's cyber agency BSI, concurred: "We expect that [to be] happening more and more during the coming months."

AI also ramps up the risks once the flaws are out in the open. Cyber agencies' recommendation that organizations take their websites offline was "really a drastic measure," Caspers said. "We wouldn't have done that a few years ago or so." But because AI has made it quicker and easier to exploit flaws, "we had to do that," he said.

At the same time, the use of advanced AI to detect the flaws may create a new level of protection against malicious hackers looking to take advantage of them. Caspers said that though his German agency has also seen attacks, it has not seen any successful use of the flaw by hackers.

"It seems a little bit more complicated than expected to exploit," he said.

Despite the fact that AI offers a new way to discover flaws, the work involved in keeping systems protected is more quotidian, with cyber agencies urging organizations to install the fix shared by the PHP Foundation, in a process known as patching.

"There are three things that you have to do right now," said van Amelsfort from the Dutch agency. "And that's patch, patch, and patch."

John Sakellariadis contributed to this report.

The Axel Springer Global Reporters Network harnesses the resources of the company's newsrooms to publish ambitious scoops, investigations, interviews, opinion pieces and analysis. It allows journalists — including those from POLITICO, The Telegraph, Business Insider, WELT, BILD, Onet and Fakt — to collaborate on major stories for an international audience of hundreds of millions across platforms: online, print, TV and audio.

• Being a mom can be challenging and expensive.
• Some have turned to apps like Uber and Lyft to make extra money — or as their main source of income.
• Fill out our survey if you're a mom who does gig work.

Uber and Lyft often talk about the flexibility of working as a driver on their apps.

That aspect of the gig has attracted moms, among other people who often want to earn money outside a 9-to-5 schedule. The job can be appealing to mothers who need to juggle school drop-offs, childcare, and other obligations of parenting.

Others, including single moms, say they feel stuck in ride-hailing work and end up having to drive for Uber or Lyft at set times anyway, depending on when the most passengers need rides.

With costs like childcare and college rising, Uber and Lyft offer some moms a way to make extra money — if they can earn enough on the apps and keep costs like gas and car maintenance under control.

Business Insider wants to speak with moms who drive for Uber, Lyft, or other ride-hailing apps. We want to hear about how you combine the gig with taking care of your kids, including both what's working and what isn't. Please fill out the survey below.

• For decades, Accutane has been a drug of last resort for persistent acne.
• A founder who designed a new platform to streamline regulatory red tape is changing access.
• People are microdosing Accutane and reporting fewer side effects. Dermatologists have mixed views.

In the dermatology world, Accutane has a reputation as the nuclear option for bad acne.

It's the only drug that can shrink oil glands, potentially clearing pimples for good. But it comes with serious risks — primarily: a high rate of birth defects if you take it and become pregnant. Other side effects include sun sensitivity, high cholesterol, mood changes, and joint pain.

Parents are scared to put their teens on it. Dermatologists often reserve it for stubborn acne, after other creams, cleansers, antibiotics, and pills have been exhausted. And strict pregnancy-prevention rules mean monthly check-ins, tests, and blood work.

But in recent years, some of the stigma around the retinoid drug, generically called isotretinoin, has started to fade, as people have gravitated to a smaller, more strategic "Hollywood dose" of Accutane. By taking small amounts of the drug, maybe just a few days per week, many patients find they can maintain a dewy, glass-like complexion on camera while avoiding painful side effects like ultra dry skin, and the initial acne breakout purge that comes with heftier prescriptions.

"I love the Accutane glow-up," Honeydew dermatology founder David Futoran, 29, said. For him, it includes hair that's less oily, and baby-soft cheeks.

Futoran is partly responsible for turning Accutane from a maligned prescription of last resort into a buzzy internet sensation. He's found new ways to streamline and digitize paperwork, turning most of the required monthly doctor's office visits and testing for the drug into something people can do at home. Honeydew is now growing 3x year over year, Futoran said, and interest in low-dose prescriptions is increasing.

Dermatologists are divided on the trend of microdosed Accutane. Yes, it is a very effective drug, and it can clear up most breakouts. But there are tradeoffs to taking an intermittent or low-dose approach, and some doctors say why bother dancing around side effects when you could get on and off the potent drug in months, and have clear skin for life?

Founder mode for skin

Futoran founded Honeydew in 2022 after spending years on various antibiotics and multi-step cleansing and cream routines, with his acne constantly coming back.

His vision was to make prescription acne care faster and more accessible. He partnered with his longtime dermatologist, Dr. Joel Spitz, to build a telemedicine platform connecting patients with providers and treatments for acne, rosacea, eczema, and psoriasis.

Yet Futoran was still hesitant to take Accutane himself, partly because of the logistical headaches.

One morning, he said, he woke up with a large, painful cyst in the middle of his forehead. That was it, he said — he decided he was finally going on the low-dose form of Accutane his company had been prescribing.

"I should have done that from the start," he said. "My skin is way less irritated than it ever was on any of the topicals, and I just have peace because I know it works."

Accutane works because it shrinks oil glands by turning down sebum production. It triggers the death of some stem cells, which is great for clearing up overactive oil-producing glands, but very bad for developing fetuses.

In addition to making regulatory compliance digital, Honeydew offers specially formulated lip balms, cleansers, antihistamines and supplements like Omega-3 designed to replace lost oil.

Bringing a celebrity skin trick to the masses

Celebrities including Chris Pine, Pete Davidson, Emma Stone, and Kendall Jenner have all been open about using this powerful oral retinoid to help clear up persistent acne. The shadow business of microdosing Accutane, though, using it as a glow up drug even for minor, isolated breakouts, happens more through a whisper system between doctors and patients.

26-year-old marketing manager and social media influencer Kennedy Faris started microdosing Accutane with Honeydew in the spring. About a decade ago, she watched her little brother suffer some of the rarer mental health side effects of Accutane, and she was worried about the possibility the drug could lead to depression.

"My brother's a very happy person, so it was really scary," Faris told Business Insider. "I was really hesitant about starting."

After struggling to get a prescription from an in-person dermatologist, Faris heard about Honeydew from a follower and partnered with the brand. She started on a low dose of 10 milligrams, working her way up to a standard 40 mg dose over the course of a few months.

After years of trying different skincare products, antibiotics, and medications, she feels like she's finally found a more permanent solution to cystic acne. There are drawbacks to being on the drug, she said, including sensitivity to alcohol, sunlight, and some nightmares. But the real benefit has been her renewed confidence, optimism, and joy, with friends noticing she's "more bubbly and happy," she said. "I was like, 'wow, I was kind of depressed.'"

Because the drug shrinks pores, Faris has also noticed her face and nose appear slimmer.

"Everyone talks about the fake nose job," she said.

Some patients recovering from real nose jobs even use the drug to lower surgery-related inflammation and shrink pores on the nose while their face heals. As testosterone therapy booms, more men are taking Accutane to deal with oilier skin. And increasingly, patients are lining up for low-dose Accutane for minor breakouts, just to be in the clear. People are gravitating to skin treatments that will give them the edge at work and on screen, Spitz said.

"Everyone's on Zoom or Google Meets or they're on TikTok or they're on Insta, and they want to look good," he added.

The potential drawbacks of microdosing

Some doctors worry that microdosing Accutane could lead to more health complications if people stay on the medication for years at a time.

"In my practice, I just basically put people on the standard dose and then they're done at five months, and then they feel much better, Dr. Ariel Ostad, a dermatologist in Manhattan who is not affiliated with Honeydew, said. "Patients, once they go on it, their skin clears up really quickly, and they're happy, and they realize it's not as bad as they thought."

A shorter treatment course means less time worrying about drug interactions, liver or heart health, pregnancy, sun sensitivity, or bone issues.

Futoran said traditional dosing can be "absolutely the right answer for some patients," and roughly 40% of Honeydew prescriptions are at standard dosages. Still, he cites studies showing patient satisfaction is higher with low-dose Accutane, and said Honeydew patients on smaller dosages have "materially better retention."

"The best clinical outcome is when patients complete their course, but faster is not always better," he said.

“Mai vista una tecnologia così sofisticata per organizzare le proteste”, dice Lorenzo Alvisi, dottorando del Programma Nazionale in Cybersecurity presso Scuola Imt Alti Studi Lucca. È tra gli autori di un’analisi preliminare sul ruolo svolto dalle piattaforme digitali nell’organizzazione delle proteste esplose il 17 ottobre. Uno studio in attesa di pubblicazione, ma ilfattoquotidiano.it può già anticiparne i dettagli. Spicca un dato: “Cinque admin e un fondatore che controllano tutto”, dice l’esperto, illustrando un messaggio in chat. Appare in automatico, ogni volta che un utente porge domande sulla struttura di comando.

Il report traccia la mappa della galassia online marchiata “Italia in piazza”, tra i detonatori delle iniziative di protesta: un sito web e circa 40 gruppi, tra pagine TikTok e 19 chat Telegram. Instagram, secondo Alvisi, è solo la copertina e la costola meno importante. “Telegram ha compiti di coordinamento, ma il motore è TikTok”, dice il ricercatore. “È il social network della generazione Alfa, ragazzini delle superiori nati dopo il 2010”, aggiunge. Dunque minorenni intorno ai 16 anni. Mentre un piccolo nucleo di sei admin controlla la rete di 19 gruppi Telegram, sorti il 7 ottobre. Il motivo? La chat WhatsApp, battezzata Italia in piazza 17 ottobre all’inizio dello stesso mese, era frenata dal tetto per gli iscritti: massimo mille. Dunque, stando al report, l’8 ottobre chiude i battenti e trasloca su Telegram, senza vincoli al numero dei partecipanti. La chat nazionale copia il nome da WhatsApp: Italia in piazza, togliendo la data. Le 18 edizioni locali si distinguono adottando nomi di città e regioni.

“Sul gruppo nazionale, al 19 ottobre, si contavano 4.073 utenti”, dice Alvisi. In totale “saliamo a 9.010, ma la stragrande maggioranza degli utenti locali partecipa anche alla pagina nazionale”, prosegue il dottorando. Le 19 chat Telegram condividono lo stesso stemma: un megafono nero. E rimandano l’una all’altra: quando un utente chiede lumi sui vari gruppi, risponde un bot offrendo l’intera lista dei link. Quando si invocano informazioni sui capi, il bot firma un messaggio automatizzato con i nomi dei profili al comando delle chat: “Fondatore: Andrea, web developer. Vice-fondatore: Ludo, staff. Amministratore: Ily, staff. @Marco, staff. @nonbannato. @ssoqquadro, moderatrice”. Sei nomi inventati, nessun indizio sulle persone reali. Non sappiamo se il profilo Andrea sia il creatore delle 19 chat Telegram. “Ora il profilo è chiuso, ma nei messaggi appare come il fondatore”, dice Alvisi. Il nickname Andrea nasce contestualmente alla chat nazionale. Suo è il primo post, il 7 ottobre. Lui è il creatore dei topic, gli argomenti discussi dagli utenti. Il mare è l’immagine del suo emblema, “iltuoprefe2” come tag per essere trovato dagli altri utenti.

Alvisi delinea la struttura al comando della galassia Telegram: “Sei admin detengono il nucleo del potere, Andrea è tra gli amministratori di tutte le chat tranne due, dove non c’è lui è presente Marco”. Gli admin tengono le redini: escludono gli utenti con un ban, decidono chi accogliere, restringono o ampliano i poteri di centinaia di moderatori, mettono in evidenza i messaggi in chat orientando il dibattito. Poche persone, una struttura decentrata, per depistare l’identificazione. Se cade una delle 19 gambe Telegram, il corpo resta in piedi. Una pianeta in grado di calamitare infinite orbite delle proteste: “Se voglio organizzare una contestazione in una scuola, conviene spedire un link in quella rete, già ricca di migliaia di nodi”, dice Alvisi. L’esperto tira le somme della ricerca preliminare: “Mai prima d’ora le proteste avevano poggiato su un’infrastruttura tecnologica così complessa e coordinata”. Sito web con link a decine di gruppi, chat e comunità, bot automatici per gestire i collegamenti, sfuggendo a ogni radar, perché “nessuno aveva idea di cosa stava succedendo”. Sabato 24 ottobre si annunciano proteste nelle più importanti città d’Italia. Sarà il banco di prova, per capire se dalle chat si scende in piazza.

L'articolo “19 chat Telegram controllate da sei admin”: chi c’è dietro “Italia in piazza”, la galassia social che organizza le proteste proviene da Il Fatto Quotidiano.