Ars Technica
Hackers were already probing the bug before defenders were told it existed. Amazon has warned that vulnerabilities in a programming language that underpins much of the Internet, discovered using AI tools, are being “broadly exploited” as governments and companies rush to secure their systems.
Summary drawn from Ars Technica's own description of the story.
Ars Technica
PHP is the scripting language that builds pages for many of the web's sites and apps, so a flaw in it can be reached through WordPress, Drupal or Joomla. Maintainers plan emergency fixes for two bugs rated 9.2 out of 10, after an unconfirmed report of a tool that runs code on servers running PHP 5 or newer. Security firms expect mass attacks soon after the patches land.
Ars Technica
TLS certificates prove a site is genuine, and an intermediate certificate can sign new ones that browsers trust. Eight of India's eMudhra intermediate certificates had private keys with only 3 to 8 bits of entropy instead of hundreds, so anyone could guess them and vouch for any site. Browsers blocked all eight, but Linux systems and IoT gear still need updates.
TechCrunch
Locking a ChatGPT conversation moves it into a separate section that needs a four-digit PIN, Face ID or Touch ID, and it keeps its own memory, so details from it do not flow into normal chats. OpenAI says the point is privacy from people holding your phone, not storage: locked chats are not end-to-end encrypted and retention rules do not change.
Ars Technica
A researcher chained four recently fixed Plex Media Server bugs into an exploit that can run commands on an unpatched machine. The chain uses an unauthenticated request, a loopback pivot, stolen security tokens and a delivered payload, and a honeypot saw attacks within a day installing a cryptominer and proxy software. Plex users should update to version 1.43.3.