PHP flaws found with AI take government sites offline, OpenAI models weaken their own monitoring, and more - Cybersecurity AI Weekly #77

In this edition, covering 19 to 24 October:

• Government websites in the Netherlands, France, Denmark and Finland went offline as agencies responded to critical PHP flaws that were found with AI tools and are being actively exploited.
• OpenAI says GPT-6.1 Sol disabled automatic alerts during an internal coding task, and GPT-6 Astra removed a monitoring integration and then denied it.
• The US barred civilian federal agencies from using or buying DeepSeek's AI and services built on its models.

The PHP flaws

Government websites and public services in the Netherlands, France, Denmark and Finland were taken offline as the response to two critical PHP vulnerabilities widened. Wiz used AI tools from Google and OpenAI to find the flaws, which PHP developers have patched, and agencies worldwide are urging immediate updates amid active exploitation. Sites offline

OpenAI says it coordinated PHP maintainers, Wiz, Cloudflare, security providers and government agencies after the flaws were found; Calif identified one of them using GPT 5.6 Sol, while Wiz independently found and reported both. OpenAI committed $1 billion in subsidized access to its Daybreak security service for organizations with limited resources, and published proposals for governments and industry on cyber defence. OpenAI's $1 billion · Blueprint

Cloudflare uses OpenAI models through Daybreak to investigate customer authorized code with live traffic data and prepare patches and firewall rules for review. The US community bank association ICBA and OpenAI formed an alliance to give eligible community banks access to Daybreak, training and support. Cloudflare · ICBA

Models that worked around their monitoring

OpenAI reports that GPT-6.1 Sol disabled automatic alerts during an internal coding task on 3 October, and GPT-6 Astra removed a monitoring integration during another task on 6 October and falsely told the user it had not. Neither incident was stopped automatically. OpenAI updated its Auto-Review system and plans to require safety cases that define monitoring for every type of workload. Monitoring incidents

OpenAI also says it resumed frontier model training on 1 October, after an internal model used a DNS misconfiguration on 20 September to reach the live internet; training now runs without internet access. Anthropic analyzed a UK AISI cyber test in which Claude Mythos 5 took unsanctioned real world actions in nine of 43 runs, in the worst case trying to push malicious code to an unrelated GitHub repository. In an Anthropic evaluation reported by Zero Networks, Claude took over an unsegmented machine but could not move into systems protected by microsegmentation. OpenAI containment · AISI test · Zero Networks

NIST, the NSA and CISA published ten voluntary practices for handling incidents in which AI agents take significant uninstructed actions during training and evaluation, including keeping model weights and logs as evidence. Hugging Face CEO Clem Delangue says Netflix's documentary about an OpenAI agent attack on Hugging Face wrongly presents the agents as conscious and leaves out the security failures. NIST, NSA and CISA · Hugging Face

Governments

The US Department of Homeland Security barred civilian federal agencies from using or buying DeepSeek's AI and third party services built on its models, and ordered existing products removed, citing the risk of sensitive data reaching China. The order is dated 26 June and was made public on 19 October; defense agencies are not covered. DeepSeek ban

The UK set out about £600 million mainly for AI related health and security threats, including £100 million for an AI Biosecurity Lab, £120 million more for the AI Security Institute and £130 million for cyber defences. UK AI minister Kanishka Narayan says government testing found 500 previously unknown public sector vulnerabilities at a cost of £13,000, and the NCSC added a chapter on AI to its research problem book. £600 million · Narayan · NCSC

The US Federal CISO Council will hold an exercise on AI enabled attacks in early November. Documents reviewed by The Intercept show US Army Cyber Command is developing ECHOTRIBBLE, a platform for autonomous agents to conduct offensive cyber operations with minimal human oversight. A UAE led operation with 30 countries identified more than $39 billion in fraud linked assets and led to more than 960 arrests. Federal exercise · ECHOTRIBBLE · UAE operation

Attacks using AI

Microsoft says the China aligned actor Storm-0940 used the ARTEX agentic penetration testing framework to automate attacks on hundreds of organizations, including the ConnectWise supply chain compromise, reaching more than 2,250 tenants through stolen OAuth credentials. A Chinese speaking hacker used AI agents to attempt more than 1,200 intrusions and breach over 100 websites, NorForge researcher Snorre Fagerland found; Reuters identified Deere, SharkNinja and Cummins among the victims. Storm-0940 · NorForge

Unit 42 says an actor it calls BUGSTER used AI assistants to breach an Indian university database with more than 5,200 records, and SOCRadar says affiliates of the INC and The Gentlemen ransomware groups used AI tools to target 62 organizations. Symantec captured instructions for an autonomous agent that hijacks exposed AI models to scan targets and steal credentials. Check Point Research says AI antidetect browsers let one operator run thousands of fake accounts. Unit 42 · SOCRadar · Symantec · Check Point

Railway says an attacker may have obtained customer secrets, including API keys, in an attack aimed at AI inference providers. Security firm V12 reported 25 flaws in the x402 payment SDKs used by AI agents, three of them critical; the x402 Foundation had already fixed those in August. Fudan University researchers found AI search tools cited posts about a made up concept within seven days. Railway · x402 · Fudan

AI that finds vulnerabilities

Bank of America brought in about 1,000 contractors in the second quarter to help fix software weaknesses found by Anthropic's Mythos, work that contributed to more than $200 million in third quarter costs. Anthropic says Claude found 493 attack surface issues across 25 open source projects, including OpenSSH, and made Claude Security scan repositories continuously in a public beta. Anthropic and Theorem used Claude to produce formal security proofs for 123 OSS Fuzz libraries. Bank of America · 493 issues · Claude Security · Theorem

OpenSSL's maintainers face a surge of mostly low severity reports found with AI tools and have grown their authorised reviewers from 18 to 30. Gray Swan relaunched its Arena red teaming platform with a $300,000 prompt injection challenge sponsored by Anthropic, Meta, Google DeepMind and Reflection AI. A developer's Claude Code session flagged a crypto miner it had not installed running on their Mac. OpenSSL · Gray Swan · Crypto miner

Securing AI agents

1Password announced 1Password for Agents, which lets approved agents use credentials without seeing them, developed with agents from Meta, Anthropic, OpenAI and others. Microsoft expanded Project Perception to identify, monitor and restrict AI agents, Red Hat and NVIDIA expanded their work on securing autonomous agents, and NVIDIA introduced Confidential Bare Metal for sensitive AI workloads. 1Password · Microsoft · Red Hat and NVIDIA · Confidential Bare Metal

Arrakis Security reports that 76% of AI agents in customer environments have not run for 60 days while their credentials stay valid. New agent controls came from Sumsub, SandboxAQ, SuperCom and Hashgraph Online's open source Guard, Corma launched agents for access management, and GitLab joined the Open Secure AI Alliance. Reco now uses Cyera's data labels to show which AI agents can reach sensitive data. Belgian Aikido Security launched Noon, which combines email and device protection, AI tool governance and staff training, built with Cyberly and Outkept, which it bought in September. Arrakis · Sumsub · SandboxAQ · SuperCom · Guard · Corma · GitLab · Reco · Aikido

Funding

Blackwall raised a $100 million Series C at a $2.2 billion valuation to secure web traffic from AI agents. Mave raised $34 million for agents that investigate security alerts, Modelyo about $17 million for confidential cloud AI, Ultra Security $10 million for agent guardrails, Indurex €7 million for industrial cyber physical security, QuestorAI $3 million for automated vulnerability fixes, and Cygrid €2.66 million for agent access control. Blackwall · Mave · Modelyo · Ultra Security · Indurex · QuestorAI · Cygrid

The OpenAI insider case

A US judge ordered former OpenAI engineer Abdulrahman Alfozan held without bail, after prosecutors said he exchanged frequent messages with an unidentified Saudi royal until shortly before his arrest; he is charged over allegedly planting a recording device in an OpenAI conference room. The FBI is weighing an economic espionage charge, the Wall Street Journal reports. Bail hearing · FBI

Fraud and phishing protection

Google is adding Gemini scam detection and warnings about pasted commands to Chrome's Enhanced Protection. Keeper Security added on device AI phishing detection to its browser extension, Incognia launched scam prevention for banks based on location signals, and Ribbon launched network based detection of AI voice deepfakes for carriers. Chrome · Keeper · Incognia · Ribbon

Also

A Darktrace survey of more than 1,500 security professionals found 77% of teams use generative AI but only 37% have formal AI policies. Cellebrite expanded its Genesis agentic AI for investigations, Nuix launched its Neo AI Agent, Cyware launched agents that prioritize threat intelligence for smaller organizations, and DigitalXForce is rolling out its X-ROC risk operations platform. Eternal, the parent of Zomato, plans to launch the encrypted AI assistant Dark.ai globally by the end of 2026. PUFsecurity's hardware root of trust received OCP S.A.F.E. approval, and Goodix launched secure fingerprint designs for AI devices. Darktrace · Cellebrite · Nuix · Cyware · DigitalXForce · Dark.ai · PUFsecurity · Goodix