The National Security Agency told organizations that if they couldn’t fix their websites immediately, they should take them offline. Not patch carefully. Not watch for suspicious activity. Pull the plug, according to the NSA’s Oct. 21 advisory.
The flaws were in PHP, the programming language behind most of the world’s websites, and they would let anyone run commands on a server without a password. Germany, France, Belgium, the Netherlands, Finland and the Czech Republic temporarily took down some government sites.
How serious was it? The prime minister of Japan went on X.com to tell her country to get ready to patch. I have spent two decades in this business, including at the Pentagon and now at Vanderbilt University, where my lab specializes in cybersecurity. I have never seen a head of government issue a patch notice like this. It won’t be the last.
Here is what should worry you: This was pretty much the best-case scenario. The flaws were found with the help of artificial-intelligence models, including OpenAI’s, and handled the way we would want. They were reported quietly in August to PHP’s maintainers, who spent two months working with OpenAI and outside security researchers on a fix before releasing it publicly. OpenAI says that, to its knowledge, AI found these flaws before attackers did.
That is luck, not a system….
AI saves the day—and could bring doom tomorrow. OpenAI identified a bug in the web and reported it. Will the next one be found by bad guys with a Chinese open model? asks Brett Goldstein https://t.co/bo3vtS8SYq
— Wall Street Journal Opinion (@WSJopinion) November 9, 2026
Leave a Reply
You must be logged in to post a comment.