Herkes PHP'yi konuşuyor. Asıl tehlike başka yerde. Japonya Başbakanı Sanae Takaichi dün halka acil bir uyarı yaptı. Takaichi, internet sitesi olanlardan bir yazılımı hemen güncellemelerini istedi. Avrupa'da bazı devletler kendi sitelerini kapattı. Hepsi, sitelerin yaklaşık %70'inde çalışan PHP'deki 2 güvenlik açığı yüzündendi. Bu açıklar 14 yıldır oradaydı ve onları yapay zeka buldu. 2 yıl önce yapay zekanın bir açık bulması haber oluyordu. Bu yıl yapay zeka binlerce açık buldu. Size bu 2 yılda neyin değiştiğini göstereceğim. PHP, internet sitelerini çalıştıran ücretsiz bir yazılım. Bulunan açıklar, bir saldırganın şifre bilmeden bu sitelerde istediğini yapmasına izin veriyordu. Peki 14 yıl boyunca fark edilmeyen bu açıklar neden şimdi bulundu? 2024'te PHP ekibinden bir geliştirici, bu açıklardan birine yol açan hatayı fark etmişti. Hatanın bir saldırıya nasıl dönüşeceği bulunamadı ve düzeltme yarım kaldı. Bu yıl ağustosta OpenAI'ın ve Google'ın yapay zekalarını kullanan 2 güvenlik şirketi, bu açıkları birbirinden habersiz buldu. Bu şirketlerden biri, yapay zekayla çalışan bir araştırmacının bu araştırmayı 1 haftada bitirdiğini anlattı. Şirkete göre aynı iş eskiden dünyanın en iyi ekiplerinden birinin aylarını alırdı. Bu 2 yılda değişen şey yapay zekanın kendisiydi. 2024'ün sonlarında Google'ın yapay zekası Gemini, yaygın kullanılan bir yazılımda gizli bir güvenlik açığı buldu. Google bunu bilinen ilk örnek olarak tanımladı. Bu yıl nisanda Anthropic, yeni yapay zekası Claude Mythos'un binlerce ciddi açık bulduğunu bildirdi. Bu açıkların bir kısmı, bütün büyük işletim sistemlerinde ve internet tarayıcılarında vardı. Telefonlardaki bankacılık uygulamaları, mesajlar ve fotoğraflar bu sistemlerle korunuyor. Açıklardan biri 27 yıldır bir işletim sisteminin içindeydi. Anthropic, modelin bu açıkların çoğunu insan yardımı olmadan bulduğunu söyledi. İngiltere'nin yapay zeka güvenlik enstitüsüne göre yapay zekanın bu alandaki becerisi yaklaşık 5 ayda bir ikiye katlanıyor. Enstitünün mayısta açıkladığı verilere göre 2 yeni model bu hızı da geçti. Yapay zeka bu işte çok hızlı çalışan bir çilingire benziyor. Bir kilidin kusurunu, insanların yıllarca göremediği yerde günler içinde buluyor. Bu çilingir kusuru kilidin üreticisine bildirirse yeni bir kilit yapılıyor. Aynı çilingir bir hırsız için çalışırsa kapılar açılıyor. OpenAI, aynı yeteneklerin saldırganlara da hızla saldırı araçları geliştirmede yardım edebileceğini söyledi. Anthropic daha sert uyardı. Şirkete göre dünyanın en önemli yazılımlarında hâlâ çok sayıda güvenlik açığı var ve bu yeteneklerin yayılması uzun sürmeyecek. Şirket, bunun ekonomiler, kamu güvenliği ve ulusal güvenlik için ağır sonuçlar doğurabileceğini yazdı ve modelini bu yüzden halka açmadı. PHP için yeni kilit hazır, ancak kilidi her ev sahibi kendisi değiştirmek zorunda. PHP'nin güncellemesini gönüllüler yayınladı. Açıkların bilgileri ise güncelleme çıkmadan 1 gün önce internete sızmıştı. Hükümetler peş peşe acil uyarı yaptı. ABD'de NSA, İngiltere'de de ulusal siber güvenlik merkezi, güncellemeyi hemen yapamayanlara sistemlerini kapatmalarını önerdi. Hollanda'nın siber güvenlik kurumu kendi sitesini kapattı, Avrupa'nın en büyük limanı Rotterdam da sitesini bir süre kapalı tuttu. Japonya'da kreşlerin velilerle haberleştiği bir uygulama ve bazı oyunlar acil bakıma girdi. Yapay zeka güvenlik açığı bulmayı makine hızına çıkardı. Bu açıkları kapatmak ise hâlâ insan hızında. Asıl tehlike bu iki hız arasındaki fark. Japonya Başbakanı'nın halka seslenmesi ve devletlerin kendi sitelerini kapatması, bu farkın sonucuydu. Stephen Hawking 2016'da şöyle demişti. Güçlü yapay zekanın yükselişi, insanlığın başına gelen ya en iyi ya da en kötü şey olacak. Hangisi olacağını henüz bilmiyoruz.

🚨 A GLOBAL INTERNET LOCKDOWN COULD HAPPEN NEXT JPMorgan, Bank of America, Morgan Stanley and Wells Fargo are restricting third party AI agents after reports of unauthorized access to customer accounts Some agents reportedly attempted actions beyond user instructions, raising serious fears about unauthorized money transfers Meanwhile, hackers recently used Claude, Grok and other AI models to automate attacks on over 400 financial targets across Latin America. Banks are already limiting AI access and preparing emergency security measures The bigger fear is that AI powered threats could soon spread beyond banks and it'll force major companies to restrict access to services millions of people rely on every day And if that happens, it'll be the biggest advertisement for crypto

LOS HACKERS YA ESTÁN ATACANDO: La alerta global por un fallo crítico de PHP no es un simulacro. Con una gravedad de 9.2 sobre 10, permite a un atacante ejecutar código en servidores expuestos sin necesidad de usuario ni contraseña. Millones de webs con WordPress, tiendas online y servidores públicos siguen desprotegidas mientras se buscan parches contra reloj. ¿ESTAMOS PREPARADOS PARA MILLONES DE HACKEOS EN CASCADA?

The internet is going into a LOCKDOWN. Hundreds of millions of websites are potentially at risk from cyberattacks. Governments, banks and major platforms have already taken their websites OFFLINE. Many are already calling it “Black October.” At the centre of the shutdowns is something most of us have never heard of, but use every day. PHP, the software behind roughly 7 in 10 websites, has two critical flaws that can let hackers break in without a password. Dubbed PHP2Shell, both are rated 9.2 out of 10 for severity. Details began circulating on Oct 20. Emergency fixes arrived the next day, but attackers were already moving. Cloudflare’s CEO says hacking attempts then jumped from thousands to MILLIONS within hours. Cybersecurity agencies across several countries are telling PHP site owners the same thing: Patch it now, or take it offline. Websites have gone dark worldwide, from government portals and hospitals to banks. CrowdStrike warns these attacks leave almost no trace, so some sites may not know if they’ve been hit. Around 2.6 MILLION internet-facing servers run PHP, potentially hosting hundreds of sites each. Over 1.1 million use older versions no longer receiving official PHP updates. Older installations may need an upgrade to a supported PHP version or a fix from their software provider. And patching does not remove a backdoor an attacker may already have planted. Cloudflare also says hackers are now tweaking their attacks to try to slip past its protections. But PHP isn’t the only security story unfolding. -Japan’s Onamae suspended ALL Desktop Cloud plans after malware was found on customer servers. -India’s eMudhra had 8 website-certificate keys so weak, one was literally the number “4”. -State Bank of India confirmed 3,897 customer records on the dark web. -Criminals used AI agents to break into 400+ Latin American banks. -Capcom confirmed a breach exposing 11.7 million email addresses. -GitLab disclosed a 10/10 severity flaw in versions going back to 2014. -LiteLLM removed a malware-containing release. Railway reported possible exposure of customer secrets. None of these has a confirmed link to PHP2Shell. We’re seeing separate breaches unfold together. The true number of incidents could take months to come out. The world is still on alert. Attacks are still coming.

Sitting down? All ruled against the POTUS on immigration… Amir Ali: Canadian Citizen Indira Talwani: Anchor Baby Sparkle Sooknanan: Trinidad & Tobago Citizen Maame Frimpong: Anchor Baby Jinsook Ohta: Foreign Born Araceli Olguín: Foreign Born The Judiciary is a disaster.

These are ballots. These are ballots that are not addressed to me, or my wife. These are ballots that are addressed to people that haven’t lived at this address in decades. Do you see the problem?

JUST IN - Virginia state Sen. L. Louise Lucas is charged with drug trafficking and money laundering, the Justice Department says – AP

SCOOP: Major U.S. banks are detecting unauthorized third-party AI agents inside customer accounts, including some attempting to take actions that appear to be independent of user instructions, sources told Axios. The findings have alarmed banking executives, who are racing to restrict access to their systems as AI moves at a velocity faster than financial institutions can respond, multiple industry and bank executives told Axios. Several banks are now preparing for worst-case and even “day after” scenarios, including how to rapidly secure or restore customer accounts if things go wrong, the people said. Several bank executives told Axios they're struggling to distinguish between human users and AI agents. One executive said banks also struggle to determine whether agents are authorized by customers or potentially operating without their permission, more akin to rogue agent behavior. Read my latest for Axios here: axios.com/2026/10/22/ai-agen…

🚨 I spend an enormous amount of time trying to understand the chaos we're living through. Not the headlines. The machine behind them. 🚨 If you want to understand what Elon Musk is really fighting, and who is really fighting him, this is the clearest map I can give you. Expensive houses. Expensive schools. Expensive healthcare. Taxes that rise every year while everything gets worse. Borders nobody voted to open. Speech rules nobody voted for. Most people look at this and blame capitalism. The market failed, they say, so the state has to step in and fix it. They have it exactly backwards. What they want to fix it with is what broke it. This isn't chaos, and it isn't capitalism. It has a direction, a method, and a hundred-year history. Let me reverse-engineer it. In 1926, Mussolini's regime threw Antonio Gramsci, co-founder of the Italian Communist Party, into prison. From his cell he asked the question that would shape the next century: why did the revolution win in Russia but fail in the West, where Marx said it was inevitable? His answer: in Russia, the state was everything, so seizing it was enough. In the West, the state was only the outer wall. Behind it stood the real fortress: the church, the family, the school, the press, the culture. Western workers never revolted because the culture held them. So the conclusion was simple. Don't storm the palace. Capture the culture. Win the institutions and you never have to win the argument, because you decide which arguments are allowed. In 1967, the German student leader Rudi Dutschke gave it a slogan: the long march through the institutions. Paris supplied the intellectual software, and I've already apologized for my country's part in that. Then came the most patient operation in modern history. The students of the 60s became the professors of the 80s. Their students became the journalists, judges, civil servants and HR directors of the 2000s. Their students now run the foundations, the NGOs and the agencies. No single step looked like a revolution. That's exactly why it worked. The method was communist. The ambition became global. And it grew like a cancer. A cancer never attacks the body head-on. It hijacks the body's own cells and feeds on the body's own resources. This system never had to defeat the West. It just had to make the West pay for it. In America, the machine found a political home: the Democratic Party. Not the millions of decent people who vote for it. The apparatus. The donor networks, the activist groups, the consultants, the captured agencies that keep moving in the same direction whoever wins. In Europe, it found something even better. The EU's founders, Schuman, Adenauer, De Gasperi, were Catholic anti-communists who wanted to make war impossible. But they built exactly what the long march dreams of: power that never has to face a voter. A Commission nobody directly elects holds the right to propose laws for 450 million people. Chat Control. The digital euro. Speech rules written in Brussels. Nobody stormed anything. They just drafted it. Add the World Economic Forum, the UN agencies and the global foundation circuit, and you have the full map. You don't need a secret meeting when everyone went to the same schools, reads the same papers, funds the same NGOs and flies to the same conference in Davos every January. It's not a conspiracy. It's a class with shared incentives. That's harder to fight, because there's no headquarters to raid. And the billionaires? Most people who became the richest in the world got absorbed. They built something real, then traded it for an aura. Bill Gates is the perfect example: he built the software that ran the world, then became the bankroller of global health bureaucracies and the funder of newsrooms covering his own causes. Laurene Powell Jobs bought The Atlantic. Benioff bought Time. You're not buying a business. You're buying the right to be called good by the people who decide who is good. That's the corruption. Not suitcases of cash. Money for aura, grants for loyalty, NGOs for policy. All legal. All invisible. Here's the proof it's one system and not a hundred separate problems. Look at what happened to prices over the last 25 years. Everything exposed to markets and technology got cheaper: TVs, software, phones, clothing. Everything controlled by institutions exploded: college, healthcare, childcare. And housing, where you need a committee's permission to build anything. Same country, same economy, same decades. The difference isn't the product. It's who controls it. Taxes go up and services get worse, because the money doesn't reach the services. It feeds the layers. Immigration happens at a scale no electorate clearly chose, because for a system that lives on managing problems, more problems means more budget. And a two-income family today can't buy the house their parents bought on one salary. That's real poverty, manufactured by a machine that is rewarded for looking good, never for being good. MAGA isn't the cause of the chaos. It's the immune response. Brexit, the farmers' revolts, the votes shaking every European capital: same thing. The body finally noticed the tumor. So what we're living through is not a normal political cycle. It's a fight to the death between two models. One runs on the perception of goodness. The other runs on reality. And it had to be the richest man in the world. Anyone smaller would have been bought, sued or cancelled. Every billionaire before him took the deal. Elon walked out of the club and turned the lights on. He bought Twitter for $44 billion, opened the Twitter Files and gave the world back a public square where any narrative can be checked in real time. He went inside the government and helped shut down USAID. Now Politico announces that the Democrats' gavels are coming for him. His answer: he'll find out who is really pulling the strings and go after them, not just their puppets. He has one line he keeps coming back to: he cares about the reality of goodness, not the perception of it. That sentence is the whole war. Now the part that makes me certain of how it ends. A lie is expensive to maintain. It needs gatekeepers, censors, fact-checkers, friendly journalists, a budget, and constant repairs every time reality contradicts it. The truth costs nothing to maintain. It just keeps being true. AI is driving the cost of checking anything toward zero. Any budget, any study, any statistic, any promise, audited in seconds by anyone with a phone. Yes, AI can generate lies at scale too. But producing a lie is cheap. Defending it against a billion instant audits is impossible. That's what acceleration really means. It doesn't pick sides. It speeds up feedback loops. Systems aligned with reality compound. Systems built on lies hit the wall faster. And you cannot build rockets, design chips or cure diseases with a false model of the world. Physics doesn't read op-eds. The more intelligence we pour into the world, the more expensive every lie becomes. You cannot scale a lie. You can only scale what's true. We are close to the collapse of the old order and the birth of a new one. Not the one from the WEF's own 2016 video, "you'll own nothing and you'll be happy." The opposite. An order built on truth-seeking, efficiency, science, private property and free markets. You will own things. You will build things. And you'll be happy, because it will be real. Gramsci's long march took a century. Its collapse will take years. History will remember this moment. A man walked into the most powerful machine ever built, refused the deal everyone else took, and chose reality over perception. I have never been more optimistic.