In a Guardian opinion piece, Chris Stokel-Walker notes that services in the Netherlands, Finland and at Wikimedia were switched off deliberately because staying online was too risky. He argues that a few overstretched developers cannot secure the web alone and that the companies profiting from it should help pay.
Microsoft Threat Intelligence attributes the breach of ConnectWise's Cloud Backup service to Storm-0940, a China-aligned group that relied on AI agents. The intrusion opened a path into customers' Microsoft 365 accounts, a sign that agents are now part of state-linked attack toolkits.
The authors of the Laws of Armed Conflict want to set guardrails on AI weapons systems. 404 Media asks whether governments will heed them.
Security experts are rattled by what some call 'Black October', a run of hacks and bugs headlined by the PHP vulnerabilities. 404 Media reports that they are unsure what comes next.
1Password is launching 1Password for Agents, which lets AI agents sign into accounts without seeing or handling the passwords themselves. Users still have to approve each sign-in request, so bots do not get free access to every connected account.
The PHP vulnerabilities have pushed businesses, hospitals, schools and governments into emergency measures. The New Stack argues this is a preview of a wider problem: AI finds bugs faster than open-source maintainers can patch them.