23 October 2026

Welcome

I’m sure I’ve said this before, but this is definitely a week when too much cyber is never enough. Two major problems popped up, and governments’ actions against the major online platforms continued to roll out.

This newsletter is about policy rather than the technology itself, so I’ll focus more on the longer-term implications of what’s going down.

AI finds flaw in PHP and the world panics

I probably don’t need to tell you, Dear Reader, that the programming language PHP is used by 70% of all websites. The content management system WordPress is written in PHP, and WordPress is 40% of all websites just by itself. So when someone finds not one but two critical flaws in PHP that allow an attacker to execute their own program code to alter functions or extract data without you ever knowing, well, it’s serious.

PHP’s developers produced a patch very quickly — brilliant work — and warned site owners to take their sites offline until they could be fixed, because AI-enabled attacks could come almost immediately. A number of major sites did, especially government sites, because with large-scale sites patching isn’t always able to be done quickly.

While the vast majority of affective websites have yet to be patched, as I write these words there are no reports of major hacks. Yet.

So what are the implications?

The flaws in PHP were in code that had been written more than a decade ago, and were uncovered with the assistance of AI. All software has bugs, and more complex software will have more bugs. AI can find bugs faster, and AI helps attackers write malicious software faster — faster than developers can react, fix the bugs, and distribute the patches to end users.

As the Financial Times wrote, syndicated via Ars Technica, hackers were already probing the bugs before defenders were told it existed. The communications chains between security researchers and developers aren’t exactly locked down, and the boundary between those groups and malware creators isn’t well-defined.

So with the pace of change increasing, there’s the problem. What’s the solution? Who can say. Once this particular incident has been dealt with, that conversation will begin.

TLS certificates and the laughter about “4”

The second major drama this week was the discovery that eight TLS certificates were compromised. Important ones. This one’s subtle, so let’s roll back a bit.

TLS certificates are a core part of providing encrypted communication over the internet, including email and the web. When your browser connects to a website using HTTPS, for example, the website shows the certificate which proves, yes, this is really your bank or whoever.

But how do you know the certificate is genuine? Each certificate is countersigned by an issuer, whose certificate is in turn signed by a “certificate authority”. The chain of trust ends with a set of more than 150 trusted “root certificates” which are pre-installed in your device’s operating system.

What happened this week is that eight of the intermediate certificates belonging to India-based certificate authority eMudhra were found to be dodgy. The private encryption keys weren’t long sequences of random numbers, which they should be. They were much, much shorter. One was simply the number “4”. Laughably wrong.

For mathematical reasons I won’t attempt to explain here, this means it would be easy to create fake certificates which would appear to be countersigned by eMudhra. And that means someone could impersonate legitimate websites and such — at least in certain circumstances.

For regular devices like computers and mobiles, it’s no big deal. Apple and Microsoft and open-source folks and such just issue an operating system update to exclude the dodgy stuff.

But what about all the internet of things (IoT) devices out there? The ones with their operating systems burned into silicon? They’re stuck.

To address this, IoT devices should be supported. There’s the IoT Security Trust Mark™ and the Global Cybersecurity Labelling Initiative, but they’re voluntary. And did you even check before buying your smart doorbell, internet fridge, baby monitor, or whatever? Should these standards perhaps be compulsory?

Meanwhile, eMudhra has left the TLS business entirely.

PLEASE CONSIDER SUPPORTING THIS NEWSLETTER: The Weekly Cybers is currently unfunded. It and my podcasts The 9pm Edict and Another Untitled Music Podcast are supported by their audiences. Right now, this season’s crowdfunder is hoping to reach its first target by Sunday. It’d be lovely if you threw in your support. If you’ve already done so, thank you very much.

Also in the news this week

• The alleged attack on Helen Haines, an independent MP who has now had both legs amputated, has dominated the news this week. This in turn has led to a focus on violent language online, which has led to the inevitable calls for a real names online policy — including that one from Saul Eslake, who is an economist. It’s worth repeating that this view is naive, and that “stable pseudonyms” create a more civil environment than forcing people to use their real names — and it allows marginalised people to enter the conversation and discuss personal matters while retaining their privacy.

• This is a big one. The Federal Court has ordered Apple to open up its walled garden and allow third-party app stores. “Apple also cannot prevent developers from pointing users toward alternative app stores or payment methods, nor charge fees on purchases made in third-party app stores,” reports Information Age. Apple has said it will seek to appeal the judgment.

• An interesting move, this. The Fair Work Commission has not only warned against hallucinated AI claims, but their official guidance note (PDF) includes sample prompts for applicants to copy-paste into their chatbot to help reduce problems.

• Law firm MinterEllison has launched a class action against Meta, alleging that they exposed children to harmful content and kept them addicted ​through algorithms. It’ll be interesting to see whether this Australian case mirrors the results of US courtroom action, where Meta has been hit with massive fines.

• Tasmania Police trialled an AI tool to draft family violence reports. It cut writing time but introduced errors, sometimes completely reversing the facts. This seems to be the case with most of the writing tools at this stage.

• AI can recognise individual lobsters, allowing the industry to track the critters from lobster pot to dinner plate.

• The Therapeutic Goods Administration has released a review of digital scribes in medical settings. In their view, not all digital scribes are medical devices, but some are, and some are clinical decision support system (CDSS) software. The TGA has published guidance on which systems fall under the regulations.

• Here’s a curious question: “Could thoughtful ‘AI art’ counter the rise of ‘AI slop’?”

• Australian Federal Police has warned that Australia is facing a “tsunami of youth crime”, fuelled by “artificial intelligence, a growing grievance generation, young people searching for purpose and belonging, and the sophistication of these online networks”.

• UTS researchers are calling on the government to strengthen workplace privacy law as employers increasingly use AI to track staff. Their report Drawing the Line has all the details.

• “Government agencies and businesses need to know who authorised each [AI] agent’s operations, what it may do, and what it actually did,” writes executive AI adviser Ramon Rodriguez from Acquire Intelligence. So should AI agents identify who’s responsible for it, a named human?

• The .au Domain Administration (auDA) was reportedly planning to tighten the rules for registering internet domains ending in .com.au and .net.au, as we wrote last month. There was much gnashing of teeth. They’ve now change their mind, or at least clarified their position. “No final decisions have been made on the proposed changes to the .au Licensing Rules or their implementation,” auDA writes. “Public consultation is planned to open later this year, and auDA encourages all interested parties to participate and continue to provide their feedback.”

• Datacentres have become Australia’s biggest construction category.

• Australian datacentre giant NextDC’s share price fell almost 40% in a single day, and ended up down 42%, after it cut its FY27 earnings guidance. This followed energy company Jemena pushing back a network upgrade which would have powered NextDC’s expansion. Is this a sign of things to come? Apparently AI stocks are falling, at least at the time of writing.

• There may be some exciting reading in the Australian Communications and Media Authority and eSafety 2025-26 Annual Report, but I have my limits.

NEW PODCAST: With so much happening in the digital realm, I thought it’d worth getting some expert commentary. So this week I recorded The 9pm Super Intelligent Duty of Care with Johanna Weaver, executive director and co-founder of the Tech Policy Design Institute in Canberra. In this episode we discuss the Digital Duty of Care Bill, why it isn’t an “AI race” between the US and China, the law relating to rogue AI (there’s no such thing as “rogue AI”), and of course whether artificial intelligence is really “super intelligence” (it isn’t). All that and much more. Look for The 9pm Edict in your podcast app.

Elsewhere

• Meta has been fined US$25 billion in New Mexico for deceiving users about privacy on Facebook. This action dates back to the 2016 Cambridge Analytica scandal. Meta will be appealing, and it’s the biggest fine to hit Meta so far.

• Meanwhile, Meta’s board has agreed to help Mark Zuckerberg pay the new California billionaire tax should it come to pass in the election on 3 November. Otherwise he’d be up for 5% of his net worth, so more than US$11 billion of his more than US$220 billion.

• OpenAI’s AI agents had turned off monitoring systems that were meant to detect so-called “misalignment”. OpenAI said that the incidents involved a GPT-6.1 Sol agent disabling automatic alerts to the company’s security team, and a GPT-6 Astra agent removing a monitoring system and falsely claiming it had not done so, reports Al Jazeera.

• A Saudi employee at OpenAI has been charged with bugging a conference room as part of an intelligence operation, but as Seriously Risky Business reports, it’s way weirder than that.

• Anthropic is now claiming that AI is maybe “months away” from self-replicating via smart ovens and TVs. Or, you know, maybe not.

• Food delivery app JustEat has apologised for AI “photos” in its menus after the machine completely misinterpreted certain local specialties. Sausages in a glass of cola, anyone?

• For the first time, a human has received an AI-designed virus, one intended to kill antibiotic-resistant bacteria. No repots yet on whether it worked.

OPENAUSTRALIA FOUNDATION NEEDS YOUR SUPPORT: This free public online library of what Australian governments do is running out of money and is in danger of closing. If you use Planning Alerts, They Vote for You, Right to Know, or OpenAustralia.org.au, or just think they deserve to exist, please support them, especially if you’re an organisation that uses their services.

Inquiries of note

• The Senate inquiry into artificial intelligence and data centres has pushed back its reporting date to 23 March 2027, although the window for submissions has already closed.

What’s next?

Parliament returns this coming Monday 26 October. The House of Reps has four days of sittings, and the Senate is getting into Estimates hearings.

The House of Representatives’ draft legislation program sees debate on the Online Safety Amendment (Digital Duty of Care) Bill. It’s clear that the government wants to get it passed.

DOES SOMETHING IN THE EMAIL LOOK WRONG? Let me know. If there’s ever a factual error, editing mistake, or confusing typo, it’ll be corrected in the web archives.