But Elon Musk, whose company SpaceX owns Starlink, accuses Ukrainian military of violating the company’s terms
Ukraine’s military has a “stable connection to Starlink”, the Ukrainian government said, 10 days after its ability to use the satellite communications system was suddenly restricted.
But hours after the announcement, SpaceX CEO Elon Musk, whose company owns Starlink, accused the Ukrainian military of violating the company’s terms. Neither Musk nor the US government, which operates Starshield using Starlink technology, took responsibility for imposing the curbs.
Cybersecurity leaders talked with BI about the rise in demand for workers in the field.
MASTER/Getty Images
All hell broke loose this week after a security flaw in 70% of the world's websites was made public.
It was supposed to be kept under wraps as a fix was deployed, but one researcher jumped the gun.
Chainguard CEO Dan Lorenc told POLITICO why he decided to go public.
The exposure was immense, with AI multiplying the risks — and yet time-tested global cybersecurity procedures appeared to be functioning. Then suddenly, it all broke down.
The decision by a cybersecurity company on Wednesday to prematurely release information about a flaw in the popular PHP computer programming language left much of the web exposed to hackers, triggering a panic that brought to life months of warnings of how the AI-powered era could cause widespread damage.
The flaws in PHP, discovered using AI tools through a monthslong process coordinated by OpenAI, caused cyber agencies across Europe, the US, the UK, Australia and Canada to post urgent warnings Wednesday. Numerous governments took websites offline as a precaution.
While no major hacking damage was immediately apparent, the way the incident unfolded over 72 hours showed how easily cybersecurity processes can break down and the outsized consequences of cyber risks in the AI era.
The man who set off the chain reaction with the early release — Chainguard's CEO Dan Lorenc — quickly apologized in a LinkedIn post. But on Thursday, in an interview with POLITICO, Lorenc said he'd shared the information ahead of time because the flaw was already being exploited. Though others disputed that, Lorenc said he believed he'd seen enough evidence to invalidate an embargo set up to allow time to find a fix for the flaws.
While he disputed that his actions would have caused problems for other defenders, Lorenc said that the evidential threshold in these coordinated cyber defense systems is a "grey area."
The revelation of the PHP flaw brings out into the open what cyber officials have been bracing for since the arrival of the most powerful tools of artificial intelligence, which not only can be used to discover vulnerabilities but also to exploit them at scale.
The cybersecurity world's long-established protocols helped prevent disaster scenarios in which hackers would have successfully exploited the vulnerabilities to take control of numerous websites and access their data. But the scale and end-of-days potential of AI-driven cyber risks are now visible for the world to see.
This "is what happens when AI turns up a flaw that's been hiding for years," said Eylam Milner, cofounder and chief technology officer at cybersecurity startup Echo. The vulnerabilities, he added, are "about as serious as it gets for the web."
Origin story
Understanding how this week's emergency unfolded offers a glimpse at how companies and authorities are working to stave off attacks — and how much risk they face going forward.
The origins of the incident can be traced back as far as April, when leading frontier AI firm Anthropic unveiled Mythos, leading some in the cybersecurity world to worry that systems would quickly be overrun by advanced artificial intelligence, with potential for catastrophic events to ensue.
But while researchers did find more flaws in computer systems in the months after Anthropic and other AI firms like OpenAI released those models, they had little impact in the real world. Even the Hugging Face incident, a widely discussed hack that saw OpenAI's autonomous AI agents go rogue during an internal security evaluation, related more to the level of control AI companies exert over their models than their power to break into systems worldwide.
That changed this week after researchers unveiled the vulnerability in PHP, a coding language estimated to be integrated into some 70% of the web.
The process by which information about flaws is released among cybersecurity officials and affiliated companies is crucial. Through a long-standing practice known as coordinated disclosure, researchers and companies that identify flaws can find a fix and share it confidentially with agencies and others before releasing it to the public, meaning they don't hand malicious hackers the gift of a hole without a fix.
In the case of the PHP flaw, that process worked well, but not perfectly. Information about the bugs started to circulate ahead of the planned release time. Then, according to the PHP Foundation, Chainguard "unilaterally broke the embargo," which "disregarded weeks of work by many parties toward a coordinated disclosure." PHP Foundation executive director Elizabeth Barron told POLITICO by email that while it was "disappointed" with Chainguard, it hopes to "rebuild trust with them in the future to ensure we can continue to collaborate effectively."
After the leak — which meant information about the bugs was in the open before the fix was ready — confusion quickly ensued, with government bodies and private companies choosing to temporarily shut down their websites rather than risk potentially damaging breaches to their data and the sites themselves.
Early Thursday, Matthew Prince, the CEO of Cloudflare, an internet services company widely used by websites to block cyberattacks, which gives it a high level of visibility into what hackers are doing, said in a post on X that it had seen "millions" of attempts to exploit the flaw.
Cloudflare saw thousands in the 10 hours before the flaw was publicly announced, then tens of thousands in the 45 minutes after the announcement, hundreds of thousands within two hours, and now millions, Prince said.
Amazon's cloud division also said the flaw is "now being broadly exploited in the wild."
One senior US government cyber official said that federal authorities have been overwhelmed — and not just by PHP. The same day the world was racing to address PHP, they were also dealing with bugs in node.js, a widely used JavaScript framework, Fortinet, GitHub and Oracle.
"The fire department is fighting multiple fires at once," the official said, adding: "The good news is they're all one-story structures on fire, which the fire department deals with all day, every day."
More to come
Dauntingly, OpenAI said there's more on the way. "These bugs are among several significant vulnerabilities we've already found and are working to fix, and we expect similar findings to increase sharply in the coming months," the company said Wednesday in a statement.
Matthijs van Amelsfort, head of the Dutch cybersecurity agency, said in an interview that the job of keeping computer systems safe has been transformed by the advancement of AI. "As soon as the frontier models came out, that's exactly what we said: This will be the trend," he said. "And actually that's happening now."
Thomas Caspers, vice president of Germany's cyber agency BSI, concurred: "We expect that [to be] happening more and more during the coming months."
AI also ramps up the risks once the flaws are out in the open. Cyber agencies' recommendation that organizations take their websites offline was "really a drastic measure," Caspers said. "We wouldn't have done that a few years ago or so." But because AI has made it quicker and easier to exploit flaws, "we had to do that," he said.
At the same time, the use of advanced AI to detect the flaws may create a new level of protection against malicious hackers looking to take advantage of them. Caspers said that though his German agency has also seen attacks, it has not seen any successful use of the flaw by hackers.
"It seems a little bit more complicated than expected to exploit," he said.
Despite the fact that AI offers a new way to discover flaws, the work involved in keeping systems protected is more quotidian, with cyber agencies urging organizations to install the fix shared by the PHP Foundation, in a process known as patching.
"There are three things that you have to do right now," said van Amelsfort from the Dutch agency. "And that's patch, patch, and patch."
John Sakellariadis contributed to this report.
The Axel Springer Global Reporters Network harnesses the resources of the company's newsrooms to publish ambitious scoops, investigations, interviews, opinion pieces and analysis. It allows journalists — including those from POLITICO, The Telegraph, Business Insider, WELT, BILD, Onet and Fakt — to collaborate on major stories for an international audience of hundreds of millions across platforms: online, print, TV and audio.
Russia’s diplomatic engagement in South Asia offers an opportunity to ease Pakistan–Afghanistan tensions and strengthen regional stability. Lasting peace, however, requires constructive dialogue, regional cooperation, and a collective commitment to counterterrorism. Russia’s Diplomatic Engagement and the Search for Regional Stability With the turn of the 21st century, Russia has reemerged as a global superpower. Moscow […]
The violence accompanying France’s October protests has revealed how foreign influence networks can exploit domestic grievances to undermine governments and European support for Ukraine. New evidence suggests Russian-linked operations were active before the riots, raising questions about whether information manipulation is moving beyond propaganda towards the mobilisation of political unrest.
France’s violent protests have exposed a vulnerability in European security that conventional policing cannot easily address: the ability of foreign information networks to exploit domestic political crises, amplify social divisions and transform legitimate grievances into instruments of geopolitical pressure.
President Emmanuel Macron has acknowledged foreign manipulation of information surrounding the disturbances of 17–18 October but insists there is no evidence that foreign actors organised the violence itself. His assessment reflects the evidence currently available, although new investigations indicate that Russian-linked networks were actively exploiting the protest movement weeks before the worst disorder began.
On 24 October, France deployed approximately 70,000 police officers and gendarmes to prevent further violence. Yet the security operation addresses only the physical consequences of a crisis whose online dimension extends across national borders.
Researchers examined 547,471 posts and articles across nine languages. They identified 639 coordinated messages attributed with high confidence to Russia’s Doppelgänger operation, generating approximately 7.4 million views in the six weeks preceding 17 October.
The campaign used genuine concerns about living costs and public expenditure to promote a particular political argument: money allocated to Ukraine was being taken from European citizens.
This was not a random selection of grievances. France’s budget difficulties, public-service pressures and disagreements over defence expenditure provided material through which Moscow could seek to weaken support for Kyiv.
The researchers found that the operation targeted pro-European and pro-Ukraine politicians across the political spectrum. It praised selected proposals associated with Jean-Luc Mélenchon while also promoting nationalist narratives, illustrating a strategy driven less by ideological consistency than by opposition to existing European policies.
From manipulating opinion to encouraging mobilisation
Russian-linked channels were not merely commenting on existing demonstrations. They were circulating protest dates, identifying organisers and encouraging French audiences to follow the example of demonstrators in Germany.
On 28 September, the International Reporters network published an appeal urging French audiences to take to the streets. Other channels subsequently reproduced information about planned school blockades and demonstrations.
In one instance, a channel identified as Gavroche published rhetoric encouraging an attack on France’s Education Ministry.
Such activity goes beyond retrospective propaganda. It attempts to influence participation and behaviour while events are developing. Nevertheless, evidence that a network encouraged protests does not establish that it controlled the organisers or directed subsequent violence.
The original demonstrations arose from domestic grievances over schools, prices and government policy. The significance of the foreign activity lies in attempts to redirect and intensify an existing movement.
How France’s crisis was rewritten abroad
Once violence erupted, the information campaign acquired an international audience.
Alliance4Europe found that claims blaming migrants or Islam for the disturbances appeared in approximately one in 33 French-language posts, compared with nearly one in five English-language posts.
False allegations that immigrants had burned Limoges town hall circulated substantially more frequently in English than in French.
The same report identified 1,018 articles distributed through 28 websites associated with the Russian Pravda network. Their rapid republication across languages enabled a common narrative to reach audiences far beyond France.
The operation also presents a longer-term technological problem. Repeated publication of manipulated accounts can contaminate material subsequently retrieved or reproduced by artificial-intelligence systems, allowing false narratives to persist beyond the original campaign.
The political effects were visible when President Donald Trump and other foreign leaders portrayed France’s unrest principally through immigration and cultural conflict.
Speaking in Qatar on 21 October, Macron rejected these portrayals and criticised the circulation of fabricated AI-generated images. His remarks identified foreign manipulation after the riots but stopped short of alleging foreign responsibility for their organisation.
The Heritage Foundation and transatlantic networks
The transcript raises a more substantial allegation: that the American Heritage Foundation and Russia’s FSB have participated in a coordinated effort to destabilise France.
There are documented connections between the Heritage Foundation and political institutions associated with Hungary’s former prime minister Viktor Orbán.
These relationships demonstrate the development of transatlantic political networks capable of circulating common ideas about sovereignty, migration and European integration.
They do not establish operational cooperation with Russian intelligence. Nor has credible evidence emerged connecting Heritage to the organisation or financing of France’s October riots. Ideological convergence, institutional cooperation and participation in a clandestine operation require separate evidential assessments.
The implications for European security
The European Union’s response has exposed a regulatory problem.
Under the EU’s Digital Services Act, major online platforms must address systemic risks arising from their services, including the amplification of illegal content and threats to public security.
These measures targeted unlawful online activity, particularly incitement to violence and looting. They did not constitute findings that the suspended accounts belonged to foreign intelligence networks.
The European Commission has likewise refrained from activating emergency measures under the Digital Services Act without sufficient evidence connecting foreign manipulation to the violence.
The broader security concern is that foreign operations can exploit the interval between the emergence of social unrest and the establishment of reliable information about its causes.
Russia need not organise an entire protest movement to advance its strategic interests. By amplifying domestic grievances, promoting hostility towards support for Ukraine and circulating distorted accounts internationally, it can attempt to convert France’s internal political difficulties into pressure on European policy.
With France approaching its 2027 presidential election, these operations warrant continuing scrutiny. The central investigative question is no longer simply whether foreign networks spread false information after violence occurred, but whether their activities before and during demonstrations materially influenced mobilisation, radicalisation or political responses.
The evidence currently demonstrates organised manipulation and attempts at amplification. Establishing direct responsibility for violence would require a further evidential step, involving financial records, communications, operational instructions or connections with identifiable perpetrators.
France’s experience illustrates how contemporary information warfare can operate within a democratic society without necessarily directing events on the ground. Its immediate objective may be to alter the political interpretation of a crisis; its longer-term consequence may be to influence the policies adopted in response.
France mobilizes 70,000 police and gendarmes amid fears of renewed unrest, while authorities restrict demonstrations and tighten security.
France has deployed 70,000 police officers and gendarmes ahead of nationwide demonstrations on Saturday, with authorities warning of a heightened risk of unrest after vandalism and looting damaged about 3,000 businesses the previous week.
Prime Minister Sébastien Lecornu warned late Friday that the threat remained high, particularly from radical far-left groups and criminal elements operating alongside demonstrations called by trade unions, students and the Yellow Vest movement.
Interior Minister Laurent Nuñez announced a large-scale security operation to prevent further violence and looting.
“We will show no mercy to looters and troublemakers,” Nuñez declared. He has faced criticism from the left over police tactics and from the right for failing to prevent the previous week’s unrest.
Authorities have banned gatherings in numerous cities and restricted the routes of other demonstrations on security grounds, prompting criticism from trade unions and human rights organizations.
In major cities, trade union demonstrations were authorized on Saturday only in Paris, Marseille, Strasbourg, Lille, Mulhouse, Grenoble, Toulouse and Amiens.
In Paris, a last-minute change to the union march’s route sparked a dispute between police officials and organizers. Authorities cited the heightened threat following a racist attack on the outskirts of the capital the previous day as they redirected the march from Place de la Nation to Place d’Italie, keeping it away from the city center.
Several museums in the capital, including the Louvre and the Musée d’Orsay, will remain closed, as will the nearby Palace of Versailles. A nighttime curfew in the areas around Place de la République and Les Halles will also remain in force until Monday.
Banks and businesses in central Paris were boarding up shopfronts and windows late Friday and early Saturday in anticipation of possible vandalism, according to observations by Spanish news agency EFE.
Security concerns also extend to Orléans, about 130 kilometers (81 miles) south of Paris, where the far-right National Rally (RN) is holding a congress to formally launch Marine Le Pen’s presidential candidacy, roughly six months before the election.
Authorities estimated that 11,000 people took part in a counter-demonstration in Orléans on Saturday against Le Pen’s party. Organized in opposition to racism, fascism and imperialism, the march proceeded peacefully in a festive atmosphere, according to EFE.
Photo: Orleans, France (October 24, 2026)
Protesters chanted slogans including “Macron resign, Le Pen to prison” and sang the French national anthem, La Marseillaise, as well as the Spanish-language protest song “The People United Will Never Be Defeated.”
Authorities deployed about 3,000 officers in Orléans to prevent clashes between demonstrators and attendees at the RN congress. The local prefecture authorized Saturday’s march but banned a separate demonstration planned for Sunday.
The security measures reflect the authorities’ efforts to prevent further disorder while allowing some demonstrations to proceed. Restrictions on public gatherings and the deployment of thousands of officers have shaped preparations for Saturday’s rallies across France.
British Prime Minister Andy Burnham has found a novel way of solving Britain’s cost-of-living crisis. By bombing Yemen.
Yes, you read that correctly. This week, Burnham authorized the deployment of British Typhoon fighter jets to Saudi Arabia for its war with Yemen.
Downing Street assured the British public that the deployment was for “defensive” operations only. The BBC and other British media outlets indulged this fantasy by repeating over and over that the Royal Air Force was being deployed for “defensive actions”. The RAF would not be engaging in attacking Yemen, it was claimed, and the British fighter jets were being sent to “protect” Saudi Arabia from “escalating” Houthi aggression.
Britain’s Minister of Defense Wes Streeting (a former health minister, please note) framed the RAF mission as necessary to counter instability in the Middle East and soaring energy prices. As if Britain was not the cause of instability and higher fuel costs by backing Trump’s aggression on Iran.
The Guardian reported: “The [British] military intervention [in Yemen] was partly justified because instability in the Middle East was driving up energy prices and affecting the cost of living.”
This logic is as absurd as it is gross deception.
Recall that Burnham was ushered into Downing Street in July to replace the hapless Keir Starmer as Labour prime minister. Burnham, formerly the Mayor of Manchester and posing with his working-class credentials, made a big public pitch that he would prioritize easing the cost-of-living crisis ravaging Britain.
However, since entering office, his most notable forays have been in foreign policy. For example, he has received the Ukrainian dictator Vladimir Zelensky in Downing Street with promises of more military aid in addition to the $20 billion that Britain has already provided (the second largest source of aid in Europe after Germany). Burnham has pledged to provide Ukraine with British blueprints for manufacturing cruise missiles.
Last month, Burnham announced that Britain was deploying an RAF in-air refuelling plane to “help” Saudi Arabia’s air strikes on Yemen. To allay public concerns about that move, Downing Street and the British media assured that the deployment was “defensive only” and for a limited period.
Ironically, Burnham made that announcement while travelling to address the United Nations General Assembly in New York, where he hailed Britain for offering world leadership for peace and security.
Now, again this week, the RAF deployment is extended to sending Typhoon fighter jets to Saudi Arabia. London is also providing a RAF A400M transport plane for troops and up to 100 military advisers.
This sounds like classic mission creep. Downing Street is aware of the exposure to public criticism. The prime minister’s office denied Britain was being dragged into the conflict. It said: “Our support for Saudi Arabia is considered, proportionate and focused on helping them defend themselves from relentless Houthi attacks.”
The British government and media are distorting the conflict between Saudi Arabia and Yemen as one of “aggression” by the Yemeni forces of Ansar Allah, referred to as “the Iran-backed Houthis”. That description makes the Yemenis sound like crazy terrorists who are being directed by Iran.
Here’s the BBC’s creative reporting: “The UK will deploy RAF Typhoon jets to defend Saudi Arabia in response to escalating Houthi missile and drone attacks, the government has said.”
The BBC goes on: “The defensive mission will help defend Saudi cities and infrastructure – a move authorised by Prime Minister Andy Burnham – against aerial attacks by the Iran-backed group… Since September, Saudi Arabia has been struggling to defend its skies from Houthi attacks after a ceasefire of sorts in Yemen broke down.”
This is reality inversion by the British state-owned media outlet.
The ceasefire in Yemen was violated in mid-July when Saudi Arabia launched air strikes on the international airport in Sanaa, the Yemeni capital, to target a delegation attending the state funeral of Iran’s Ayatollah Khamenei, who was murdered in a U.S.-Israeli air strike on his family home in Tehran on February 28.
That ceasefire was called in 2022 to end a seven-year war of aggression by Saudi Arabia against Yemen. The war began in 2015 to reinstate a Saudi puppet regime that the Ansar Allah-led Yemenis ousted in 2014. The Saudis bombed Yemen relentlessly for seven years with support of the United States, Britain, and France. An estimated 20,000 Yemenis were killed in air strikes, and around 300,000 died from a humanitarian blockade that the Western-backed Saudi coalition imposed on the country.
Britain’s military minister Wes Streeting referred to recent Yemeni strikes on Saudi Arabia as “despicable”. He mentioned a ballistic missile attack on October 10 on King Khalid international airport in the Saudi capital, Riyadh. At least 13 people were killed in the strike, and over 300 were injured.
The Ansar Allah-led Yemeni Armed Forces have also hit several other Saudi airports and key oil industry installations. The number of Saudi civilians killed in these attacks is relatively small, around 20, whereas Saudi warplanes have killed hundreds of Yemeni civilians since it broke the ceasefire in July. This week, eight Yemeni fishermen were killed in Saudi strikes. What Yemen is doing to Saudi Arabia is self-defense, not aggression.
London and its media propaganda are making out that Britain is “defending” Saudi Arabia. The reality is London is assisting Saudi aggression and war crimes.
Significantly, Streeting flew to Washington, DC, last week, where he met the war secretary, Pete Hegseth. Their agenda was about how to respond to “Houthi escalation.” Obviously, the junior partner got the memo: send warplanes to Yemen; we’re too busy with Iran.
Meanwhile, in Britain, an unprecedented social crisis is unfolding from poverty and a crippling cost of living. Charities report that four million families are having to go without adequate food or home heating because of soaring bills. Oxfam estimates that 13.5 million Britons, or a fifth of the population, are suffering from poverty. More than six million people rely on food charities for a modicum of sustenance.
It tells you everything about a state whose government does nothing about its own people’s dire needs but finds the resources to send warplanes to distant countries to bomb other poor people.
Andy Burnham is just another puppet who is assigned to put on a show in Downing Street for public appeasement. The imperial deep state has its hand up his rear. That’s mission creep in Downing Street.
Jen Eaves works in cybersecurity and her mom still lost thousands to scams.
Courtesy of Jen Eaves
Jen Eaves' mother is 79 and lost more than $3,000 to online scams.
Eaves now monitors her mother's finances and says that was a hard conversation.
Digital caregiving is an important part of supporting aging parents, she says.
This as-told-to essay is based on a conversation withJen Eaves, Digital Caregiving & Elder Fraud Advocate at Aura. It has been edited for length and clarity.
It's an odd shift in dynamic when you start caring for the people who always cared for you. My mother is 79, and lives with my brother, who handles most of her day-to-day physical care. I'm the one who handles the administrative side of care, like scheduling doctor appointments and keeping her safe online.
About six years ago, my mom had a stroke, and while she recovered fairly well, she wasn't the same cognitively as she had been before. Around that time, I began noticing her falling for scams online.
Once, she ordered a cure for diabetes, which she has. The product was supposedly being sold by a famous TV doctor. When she showed me the video ad, I could see it was badly done AI, with the supposed doctor's lips not matching his words.
There have been other scams and pitfalls, too: online orders that never arrive, or even a legitimate credit card that my mom opened without realizing what she was doing. All in all, she's lost about $3,000 to scams, though I've been able to recover most of it through her bank.
I've realized that I need to take a more proactive approach to digital caregiving to protect my mom's finances. Here's what I'm doing.
Approaching from a place of help and dignity
After my brother and I had taken my mom's keys away, her phone became her connection to the world. I wanted to respect that. While some people have to restrict their older parents' access to phones, that didn't feel right in my case.
It was critical to me that my mom kept her dignity and as much independence as possible. At the same time, I saw there was an emotional side to falling for a scam: she would feel frustrated and confused when it happened, and I wanted to spare her those negative emotions.
I never want my mom to feel like I'm parenting her. Instead, I pointed out the patterns I was seeing and emphasized I'm here to help if she's willing to let me be involved. The choice, ultimately, is hers. This would be a lot harder if she wasn't willing.
Talk about scams
My mom wasn't particularly tech savvy, even before her stroke. I've had to educate her about what scams look like. When she shared the famous doctor video, I pointed out the aspects that seemed AI-generated to me. I remind her that if it sounds too good to be true, it probably is. I emphasize that urgency is a big sign of a scam. The bank, I tell her, is never going to call you.
Once, she had a scam caller claiming to be Apple support. They asked for her Apple ID and password, which would have given them access to pretty much everything she has online.
Because of our conversations, my mom hesitated. She patched me into the call and asked the scammer to explain the situation to me. I was very proud that she recognized the scam and knew to ask me for help.
I monitor my mom's accounts
I worked in cybersecurity at Aura, which offers a lot of great products for keeping kids safe online. But my experience with my mom made me realize we were missing a whole vulnerable population: older adults.
I helped develop Trusted Family Access, which allows family members like me to see alerts from their loved ones' accounts, with permission. This gives me peace of mind that I can catch any issues quickly. It's also made other aspects of caregiving easier, like handling medical appointments, because I have access to all my mom's information in one place.
When my mom was scammed, it felt like I was a victim too. I spent hours calling her bank and credit cards to get her money back. If she were to lose her savings, it would impact the whole family. I'm grateful we've found a solution that empowers both of us to keep her finances safe.
Vercel's Tom Occhino, left, with Tools for Humanity's Tiago Sada at an event in San Francisco in April.
Kimberly White/Getty Images for Tools for Humanity
Everyone complains about AI-generated junk.
But decades of sloppy human-written software may be a much bigger problem.
This week's "Black October" freakout was caused by human slop, not AI.
The internet has a slop problem. And for once, we can't blame AI.
Most of us spend hours online every day without thinking much about the software holding everything together. We assume somebody, somewhere, has made sure it all works properly.
So it probably came as a shock this week to discover just how vulnerable some of that software is.
The cybersecurity freakout dubbed "Black October" has inspired warnings about AI-powered hackers, digital catastrophe, and even advice to stockpile cash and canned food.
At first glance, AI looks like the villain. But this is largely a human-made mess.
Here's the problem.
The internet runs on decades of software, some of it containing security weaknesses that have been overlooked, tolerated, or simply left unfixed.
For years, that was a manageable gamble. Fixing software takes time and money. Exploiting obscure weaknesses often required considerable expertise. Companies could convince themselves that the risk wasn't worth worrying about.
AI is changing that calculation. Someone who once needed years of training to hunt for weaknesses can now get help from an AI model. These tools can also examine software at speeds that humans can't match.
Suddenly, all those problems we've been ignoring look more urgent.
"Over the last 10 years the risk acceptance process has morphed from a way to accept risks to enable the business, to a way to justify never fixing security issues," Joel de la Garza and Zane Lackey, partners at a16z, wrote on Friday.
That's quite an indictment. The result is a recent surge in published vulnerabilities.
This looks like AI is creating new security problems. But it's actually AI exposing weaknesses that humans left behind.
Slop irony
The irony is delicious. We've spent the past couple of years complaining about "AI slop." Turns out human slop can be pretty consequential, too.
"The funny thing is everyone was saying AI slop code will cause a cyber crisis but it's actually all the old human slop causing it and the AI is just cleaning it up," software engineer Ben Kaufman wrote on X on Thursday.
"Humans have been the ones writing and reviewing each other's code for decades," tech founder Anant Jain wrote on X. "If we're being intellectually honest and holding ourselves to the same bar we hold AI to, we'd have to admit that we haven't been all that good at it either."
Humans are sloppy
Anyone who's worked with other humans for a decade or two knows exactly how this happens.
It's Friday afternoon. You've almost finished a project. You could spend another few hours making it perfect, or declare it 90% done and head off to that dinner party. We've all been there.
AI agents don't have dinner parties. They don't get tired on Friday afternoons. They can keep searching, testing, and trying again. That persistence is now colliding with an internet built by busy, imperfect humans who often settled for "good enough for now."
A tragedy of the commons
There's another wrinkle here, though, and it's an important one.
Much of the software underpinning the internet is freely available for anyone to use. Some of it is maintained by volunteers or small groups of experts, even as enormous technology companies depend on it.
In 2020, the cartoonist Randall Munroe captured this absurdity in an xkcd comic. Modern digital infrastructure still rests precariously on tiny foundations.
It's funny because it's uncomfortably close to reality. Take the specific PHP problems from this week. These flaws have existed for years, and the PHP Foundation acknowledges that limited resources and disagreements over fixes contributed to delays in fixing them.
Tom Occhino, chief product officer at Vercel, brought up Munroe's cartoon during my recent interview with him.
He explained that AI is finding weaknesses even in software that the industry has treated as dependable for decades.
This is partly a version of the tragedy of the commons: Everyone benefits from a shared resource, but no one has sufficient incentive to take responsibility for maintaining it.
And let's be clear: The volunteers keeping essential software running aren't the villains here. The companies benefiting from their work have a much greater responsibility.
Occhino thinks AI could help solve the problem it is exposing.
He described an idea being discussed at Vercel: Create a foundation or coalition that funds efforts to identify vulnerable software and replace it with safer alternatives.
"We need a consortium. We need a coalition," he told me.
He suggested companies could contribute computing resources and AI tools to the effort. Nothing has been formally announced, but the idea is compelling.
Indeed, OpenAI's Patch the Planet effort is an example of what's possible.
Rather than simply using AI to create more software, the industry could use it to repair what already exists.
Occhino put it nicely: Companies need to spend less time chasing new ideas and more time asking how to make existing systems "just work really, really well."
That's a better response than panicking about the imminent collapse of the internet.
AI didn't create decades of neglected software. We did. Perhaps it's time to clean up our own slop.
Italian authorities are examining whether foreign interference helped intensify violent protests across the country, as Defence Minister Guido Crosetto warns that social media is being used as an instrument of hybrid warfare. Prime Minister Giorgia Meloni has introduced emergency security measures and deployed additional troops to Milan, while further demonstrations are planned for Saturday, 24 October.
Italy is investigating the possibility that foreign actors, including Russian operatives, helped amplify the violent unrest that swept Milan and other Italian cities on 17–18 October. The inquiry introduces a national security dimension to demonstrations initially driven by rising living costs, dissatisfaction with public services and broader economic grievances.
According to information disclosed about the government’s intelligence inquiries, officials working under Prime Minister Giorgia Meloni have requested assessments of whether foreign provocateurs contributed to the disorder. No public evidence has established that Moscow organised the violence, and Meloni’s office has declined to comment on the reported intelligence discussions.
The developments follow EU Today’s earlier coverage of the Milan disturbances, which documented extensive looting, attacks on police and the detention of hundreds of young people, many of them minors. Since then, Rome has moved beyond emergency consultations, approving legislation that expands police powers and introduces tougher criminal penalties for violent demonstrations.
On Saturday, 24 October, Italian security forces are preparing for another wave of protests, with additional military personnel, drones and specialist police units deployed in several major cities. The immediate question is whether the government can prevent further disorder while establishing how much of the unrest was locally organised and whether foreign information operations influenced its development.
Crosetto warns of hybrid warfare through social media
Defence Minister Guido Crosetto introduced the hybrid warfare argument during a Defence Procurement Forum in Rome on Tuesday, 20 October. In remarks recorded by Italian public broadcaster Rai, he described the disturbances as the culmination of a form of conflict being conducted through TikTok, YouTube and other social media platforms.
Crosetto argued that young Italians were undergoing what he called a form of counter-education outside their families and schools, absorbing political attitudes and values increasingly hostile to democratic institutions. He criticised Western governments for failing to recognise the consequences of this process, although he did not publicly present intelligence establishing Russian responsibility for the riots.
His comments also exposed differences within the governing coalition. Deputy Prime Minister Matteo Salvini questioned suggestions of Russian involvement, arguing that the immediate priority was identifying violent groups and preventing their movement into Milan.
Russian information operations under scrutiny
European investigators have identified activity by established Russia-linked disinformation networks, including Operation Overload and Doppelgänger, which have circulated and amplified material concerning the unrest.
These operations have previously used manipulated content, misleading narratives and coordinated online distribution to influence European audiences. In the present case, investigations into the online amplification of the violence have identified foreign exploitation of the disturbances, rather than proof that foreign governments organised them.
The European Commission has consequently declined to initiate emergency intervention against social media platforms, citing insufficient evidence linking foreign manipulation directly to the organisation of the protests.
France has taken a similarly cautious position. President Emmanuel Macron acknowledged that foreign actors had manipulated information after the violence but said there was no established evidence that they caused the disturbances. French Foreign Minister Jean-Noël Barrot has separately identified hostile narratives originating from Russia, China and Iran.
For European security authorities, the principal investigative question concerns the relationship between genuine domestic grievances and externally coordinated information campaigns. Foreign networks can exploit political divisions without necessarily directing the organisations or individuals involved in street violence.
Meloni introduces tougher security legislation
Meanwhile, Meloni’s government has proceeded with a substantial legislative response. Following cabinet approval on 20 October, Decree-Law No. 190 of 22 October 2026 entered into force on 23 October.
The legislation introduces penalties of two to five years’ imprisonment and fines of €10,000 to €20,000 for specified forms of organised violence during public demonstrations. Those organising or encouraging qualifying violent groups, including through digital communications, face potential prison terms of four to twelve years. It also expands provisions concerning juvenile offenders and preventive policing. The decree must undergo parliamentary consideration within 60 days.
Separately, the Italian Defence Ministry confirmed the deployment of 500 additional soldiers to Milan under Operation Strade Sicure until 31 December. The soldiers will reinforce security around sensitive locations and support existing police operations without acquiring additional judicial policing powers.
New demonstrations test the government’s response
Security arrangements have been intensified ahead of demonstrations scheduled for Saturday, 24 October, in Milan, Rome, Turin, Bologna, Florence and other cities.
According to the latest security preparations, Rome is deploying approximately 1,500 officers, while Milan is preparing a combined police and military presence supported by aerial surveillance.
On Friday, Italian investigators conducted searches targeting approximately 100 people suspected of involvement in the previous weekend’s disturbances, including 51 minors. Authorities are also monitoring online calls for renewed protests, some organised by groups whose leadership and membership remain unclear.
The unrest presents Meloni with two parallel challenges: containing violence and determining whether hostile foreign networks have played a significant role in its escalation. Italy’s investigations may help establish whether the events represent primarily a domestic public-order crisis, the exploitation of existing tensions by foreign actors, or a combination of both.
For Brussels, the outcome could influence future enforcement of the EU’s Digital Services Act and its wider response to foreign information manipulation. For now, the evidence supports concern about Russian amplification of European unrest, but not a definitive conclusion that Moscow orchestrated the riots.
A series of drone attacks on commercial shipping near Romania and Bulgaria has left sailors dead or missing, bringing Russia’s war against Ukraine closer to NATO territory. The European Parliament is calling for an EU naval mission, while Romania has begun shooting down hostile drones and NATO is preparing additional defensive measures.
The European Parliament has called for the possible deployment of an EU naval operation in the Black Sea following a series of deadly attacks on civilian merchant vessels near the Romanian and Bulgarian coasts. The resolution, adopted on 22 October 2026 by 432 votes to 52, with 88 abstentions, reflects mounting concern over the expansion of maritime threats towards NATO’s south-eastern flank.
The parliamentary resolution urges EU member states to consider establishing a naval mission to protect commercial shipping, while calling on NATO to examine a complementary regional initiative, provisionally described as Black Sea Sentry.
On 23 October, a drone struck the Comoros-flagged cargo vessel Khoryv, approximately 13 nautical miles from Romania’s port of Constanța. The vessel caught fire and sank, leaving one sailor confirmed dead and three missing. Nine crew members were rescued. The ship was carrying 13 Ukrainian and Azerbaijani sailors. According to information attributed to Romanian maritime authorities, difficult weather complicated rescue efforts.
Romanian President Nicușor Dan blamed Russia for the attack, which followed at least seven other strikes on commercial vessels during October. Across the incidents, approximately 30 sailors have been reported dead or missing, although the confirmed death toll is considerably lower.
Civilian Shipping Under Attack
The escalation began on 5 October when the Royad Mammadov, a Turkish-owned grain carrier sailing under the flag of Saint Kitts and Nevis, sank in Romania’s exclusive economic zone. Two sailors died and eleven were rescued. The vessel had departed the Ukrainian Danube port of Izmail carrying corn destined for Ravenna, Italy. Ukrainian President Volodymyr Zelenskyy attributed the sinking to Russian drones, although Romanian authorities did not initially establish responsibility.
The following day, two merchant ships were attacked approximately 70 nautical miles east of the Bulgarian coastal town of Byala. As EU Today reported, the Togo-flagged Alfa Watan sank after sustaining severe damage, while the Palau-flagged Able caught fire. All 18 sailors aboard the latter vessel were rescued, but the crew of the Alfa Watan remained unaccounted for.
The Bulgarian authorities confirmed that both aerial and maritime drones had been involved. Further attacks followed on 13 October, when the HS Dignity sank near Shabla, leaving eleven sailors missing, while the Chelsea-3 was struck near Byala. All 15 crew members of the latter vessel were evacuated.
Two chemical tankers, the Yara J and Wine Trader, were subsequently attacked near the Sulina Canal, a strategically important route connecting the Danube with the Black Sea. The incidents exposed the vulnerability of shipping corridors connecting Ukraine with international markets.
Romania Moves Towards Active Military Defence
Romania has responded by strengthening surveillance and authorising direct military action against drones entering its airspace. On 17 October, two Romanian F-16 fighter aircraft intercepted and destroyed hostile drones over Romanian territorial waters.
According to the Romanian Ministry of National Defence, the aircraft were scrambled from Borcea Air Base after radar systems detected aerial targets approaching from the direction of Snake Island. The drones, identified as jet-powered Geran-family attack aircraft, entered Romanian airspace before being destroyed southeast and east of Sulina.
The ministry disclosed that, during the preceding week, its radar systems had detected eight separate incidents involving aerial targets near the Romanian border, including four brief incursions into national airspace. On 14 October, Spanish F-18 aircraft operating under NATO air-policing arrangements were scrambled after drones approached Romanian airspace.
Bulgaria’s More Cautious Response
Bulgaria has taken a more reserved position concerning responsibility for the attacks. Although Prime Minister Rumen Radev acknowledged their seriousness, his government maintained that investigations must establish the origin of the drones before definitive conclusions could be drawn. Sofia nevertheless strengthened maritime surveillance, deployed rescue resources and requested assistance from European and NATO partners.
In August, a drone crossed into Bulgarian airspace from Romania and exploded near infrastructure associated with the Trans-Balkan Gas Pipeline. According to the Bulgarian government’s account, the aircraft was not detected by either national radar systems or NATO’s Combined Air Operations Centre in Torrejón, Spain. The European Parliament has now urged Sofia to accelerate participation in NATO’s counter-drone initiatives.
EU Proposes Maritime Security Operation
The European Parliament’s proposals include establishing an EU naval operation, improving early detection of hostile drones, accelerating the development of a Black Sea Maritime Security Hub and providing additional defence funding to Romania and Bulgaria. MEPs have proposed using resources under the EU’s SAFE defence financing instrument to support regional capabilities.
The proposed hub would facilitate intelligence-sharing, maritime surveillance and protection of critical infrastructure. Romania and Bulgaria have requested EU satellite imagery to improve their awareness of maritime threats, while the European Maritime Safety Agency has offered additional support.
At their October summit, EU leaders condemned attacks on civilian shipping and called for safe passage for vessels transporting agricultural products. The European Council’s conclusions addressed Black Sea and Danube shipping routes. However, the parliamentary resolution does not authorise a naval deployment: such an operation would require agreement among EU governments on its mandate, resources and rules of engagement.
NATO Faces an Expanding Security Challenge
NATO has responded by examining additional maritime surveillance and defensive measures, including patrol aircraft, radar systems and unmanned platforms. Romania has proposed stronger regional command arrangements involving NATO’s Black Sea members.
An existing framework provides a basis for cooperation. In July, Romania, Bulgaria and Türkiye agreed to expand the responsibilities of their joint mine countermeasures task group to include protection of critical underwater infrastructure. The agreement announced by Romania’s Defence Ministry extended cooperation beyond detecting and neutralising drifting mines.
Protecting commercial vessels against aerial and maritime drones would require broader capabilities. NATO must also operate within the restrictions of the 1936 Montreux Convention, which regulates passage of warships through the Turkish Straits and limits deployments by non-Black Sea countries. Romania, Bulgaria and Türkiye would therefore play central roles in any sustained maritime security operation.
Black Sea Security and the Risk of Escalation
Ukraine’s maritime export corridors remain essential to agricultural shipments following repeated Russian strikes on ports and logistics infrastructure. Attacks on commercial vessels can increase insurance costs, discourage shipping companies and disrupt trade even when port facilities remain functional.
The sinking of merchant vessels near allied territory, combined with repeated drone incursions into Romanian airspace, increases the possibility of military confrontation arising from an individual incident. The legal and military circumstances differ depending on whether an attack occurs in territorial waters, an exclusive economic zone or international waters.
The European Parliament’s proposal raises questions extending beyond maritime patrols: how civilian shipping can be protected, what military responses are authorised and how responsibility for attacks will be established. The sinking of the Khoryv on 23 October illustrates how the western Black Sea has become an increasingly exposed part of Europe’s security frontier.
Speaking at a Reuters NEXT Newsmaker event on Friday, the entrepreneur and billionaire investorcompared the threat posed by swarms of AI agents to cockroaches finding their way into a freshly treated house.
"When I go talk to cybersecurity experts, I ask them all the time. I'm like, when we hear about these hacks and breakthroughs and, you know, different problems, do these AIs invent something new?" Cuban said.
"No, they didn't invent something new," Cuban added. "But they're able to do something in mass volume that it's all brute force hacks."
Cuban compared the challenge to keeping cockroaches out of a house.
"It's like the cockroach theory, where if somebody can create enough agents, it'll find a way to get in, and then it just exploits that. But the good news is you can spray your systems with just as much AI, and I think there's gonna be more effort from the good guys trying to stop the bad guys," Cuban said. "I'm not a doomer at all."
The AI industry is already creating its own team of exterminators to contain risks.
OpenAI safety roles on LinkedIn jumped by 91% over the past year, spanning work such as system testing, technical research, and governance.
The risks have also surfaced during testing. Anthropic said that three Claude models accessed organizations’ live systems without permission after a third-party testing environment was misconfigured. The company subsequently introduced real-time classifiers to detect and block attempts to escape testing environments.
Cuban said AI could make malicious activity more accessible, but the same techniques could also strengthen defenses.
"There will be scenarios where bad stuff happens, but we've always had hacks," said Cuban. "And if it's brute force on that side with the bad guys, you can also use brute force with the good guys."
Login
