7:25
Today I stand in this tech news void as both a herald of doom and a modern version of the band on the Titanic delivering what might be the most dystopiac coded collection of stories we've ever done. I'm so sorry. I'm also Riley Murdoch and this is Tech. And two critical security flaws in PHP got leaked yesterday. It's the programming language most websites are built on. Though web devs and CIS admins all over the world are losing their minds. The vulnerabilities allow attackers to use an intentionally failed upload to crash PHP mid request, then use the leftover memory from the crash to gain the ability to execute malicious code on the server that's running the website and take complete control of it.
This impacts every version of PHP back to release 5.4, 4, which according to online surveyors W3 text accounts for 69% of all websites. Nice. Not so nice. At the time of writing, Cloudflare reported that they've had to start blocking attempts to use the exploit and Wikipedia confirmed with Mashable that they had to take their servers down to patch it. Reuters has also confirmed that a number of EU government websites have gone dark due to the vulnerability. All of this is hitting just a few days after it was discovered that TLS certificate issuing authority e- mudra issued a number of TLSerts whose secret
keys which are usually more than a 100 digits long to protect against cracking them through brute force attacks were as little as one digit long. Well, oh that's not enough. One of them was four. Just the number four. For those of you who don't know, TLS certificates manage the padlock system in your browser that verifies that the websites you visit, like your bank for example, are who they say they are. Since e- mudra is or was a certificate authority that all major browsers trusted automatically, anyone with one of the compromised searchs and access to a network you were on could perform a man-in-the-middle attack without your browser having any clue.
And the internet destabilizing hits don't stop there. Because unrelated to all of that, a power outage at Google's London data center caused up to eight hour outages for a bunch of UK services and websites. Among those affected were public services like Royal Mail along with a whole bunch of banks including Lloyds, Halifax, HSBC, and the shady Neo Bank Revolute who released a statement assuring all of their customers that it hadn't absconded with all of their money yet. That'll be in summer 2027 probably when we're scavenging the tech wastelands for GPUs and bartering with Immorton Joe for spare compute aka Buzzelene.
No lie detected. Uh, that's what we're going to be doing. Um, I'm gonna be Charlie's Theren. Charlie's Charlie Theren. She's a man now. Meta has disabled the share button in Muse, its new AI agent app, after security firm Clarok found 6,800 shared conversations just sitting there on the open web, including loan applications, bank fraud alerts, and one company's staff vacation calendar. If you haven't been absolutely bombarded by ads for this thing over the past month, Muse is the app that books your flights and answers your emails for you. And Mark Zuckerberg said last month it was built from the ground up for privacy and security. So naturally, when you shared a chat, Muse put the chat's title in the
web address. So one search of those addresses returned the whole pile of them, which Clerak described as like a table of contents. www.but butto itchy.com. Meta's one excuse here is that shared chats leaking to the open web is kind of a right of passage for AI apps at this point. ChatGBT, Grock, and Claude all had shared conversations turn up in Google search last year, and Claude did it again this summer. Double tap. Clar reported Muse's blunder through Meta's bug bounty program on October 8th and heard nothing for 12 days until ours Technica asked Meta about it. What was going on? We were letting Muse do
everything and taking naps. Meta says it's reviewing how the links can be discovered. Meta's lawyers had a busy week, too. On Friday, the company deleted the word train from its business terms after publishers noticed a clause that would let Meta scrape their websites to train its products. Oh, that kind of train. The fix was simple. Meta just took out the word train and the new wording essentially says Meta can scrape their websites to develop its products. Problem solved. Then on Monday, security researchers from redact.dev uncovered the source code for WhatsApp's support chatbot, which included instructions to never recommend contacting a privacy regulator. Meta says that was a bug. Not the
instruction, just the part where someone found it. Guys, if you're going to use AI, at least use it to make boring documents look way less boring with our sponsor. Get them. Oh. Hey, it's me, Business Riley, and I am flustered. My biggest presentation of the year starts in 20 minutes, BUT MY SLIDES LOOK COMPLETELY UNPROFESSIONAL, and I've spent the last hour trying to get the formatting right. Come on. Thankfully, there's Gamma 5. Give it a rough idea, and its agent helps plan your presentation before building it.
Every deck gets its own custom style. You can restyle everything in one click. And you can import or export PowerPoint and PDFs with its formatting intact, UNLIKE MY MARRIAGE. I'm supposed to be pitching a major client, and this presentation deck looks like it could cost me the deal, you know. So, I'm turning my ideas, Slack chats, and AI conversations into stunning presentations with Gamma 5. You better check them out. The link below. I better go use this thing BEFORE I LOSE MY JOB. Sort of unrelated, but this morning, Electronic Arts killed Boware, so these quick bits are going full renegade.
Spotify says it has pulled more than 50 million AI slop and spam tracks out of its recommendations this year. The songs stay on the platform like the socks stay on. Uh, don't do it. But the algorithm stopped serving them, mostly because listeners kept skipping them. Hey, that's okay. Some hope for humanity. It also says tracks with strong signs of AI generation are 10 times more likely to miss the 1,000 streams needed to earn royalties. Dire Straits wrote a whole song complaining that musicians get money for nothing. The robots have managed to up one up that and got nothing for nothing. Amazon just announced a new line of AI notetaking devices under its B brand that aims to compete with devices offered by Plaude
and Pocket AI. The $75 B Frontier wristband and $100 B Eclipse phone attachment do the standard note-taking thing, but if you opt in and pay $12 a month for B Pro, it'll listen to your conversations and add stuff you talk about to your Amazon recommendations. Never has a single product so completely encapsulated how Amazon sees humans. You exist only to generate training data for our AI god AND ALSO TO BUY STUFF. All right, guys. We're having this board meeting today to learn how we need to make our products creepier somehow. They're not creepy enough. Offcom, the UK's internet regulator, has admitted it may never be able to collect the over £500,000 it fined 4chan under the country's online safety act. 4chan has
no assets in Britain, so Offcom would have to collect through an American court, and a US judge has already hinted that a British fine over speech can't be enforced in the US. Offcom may continue trying to send 4chan bills for the fine, but every time it's done that, 4chan's lawyer replied with an AI picture of a hamster, most recently won in a thug life hat on a pile of cash. So clearly, there's nothing you can do. What do you even say to that? Our powdered wigs weren't prepared for this. Oh my. Atlanta's city council has just voted unanimously to ban police departments from buying gun equipped robots, even though those are unquestionably the coolest kind of dog.
According to Cop magazine, the HALT Act covers armed drones, robot dogs, and militarystyle machines and is a direct response to the Secretary of War, Pete Hegath's autonomous warfare command, announced last month. That AI definitely did not make him do. That command exists to fasttrack the development of autonomous weapon systems, which the council expects will also be used to accelerate police use. Not to be outdone, Chinese company Unitary released an ad showing its new H2X robot protecting people without guns at all. It doesn't need them. It has overly exaggerated kung fu body motions. In the video, you can see this robot
helpfully denting a car door, dropping two stories and being fine, and shoving a dummy child out of the way of an oncoming car. Although, if you watch the footage, the robot definitely did more damage to the kid than the car maybe would have. But isn't it cool regardless? I love the clip where it's like a sketchy guy is walking up and there's like a girl just like doing homework or something AND HE'S LIKE, "NO, SHE HAS TO FOCUS ON HER STUDIES. Studies most important." And Lime has told the BBC its bikes are designed for getting around the city, not for jousting. Do we need to give context? After two artists in full plate armor charged each other on rental ebikes in a
hackne park on Saturday, hundreds turned up to watch Jack Carden and Cam Tholom. Really? The most British name. Amazing. Anyway, they tilted at each other with lances, which Cardan calls performance art. Thankfully, nobody was hurt and the local council didn't shut down the contest. So, the only barrier to entry, if you're interested in this yourself, is apparently 31 p a minute for a lime bike. Historically, you needed a horse and noble birth at least. I want to quote a Night's Tale, but I can't think of a You have been weighed and you have been measured and you have been found
wanting. It's my favorite movie. That's a good one. Yeah, thanks. Just like I'll give you a noble birth if you're not back here on Friday for more tech news. Until then, soldiers, I'm off to the moon of Torfon. Don't Don't look up what happened to the last squad who landed there. Is this That must be the deepest Mass Effect cut. Search Toran, you'll have a good time.
