{"type":"rich","version":"1.0","provider_name":"Transistor","provider_url":"https://transistor.fm","author_name":"The AI Cookbook Show by Malcolm Werchota","title":"#136 - The Vulnerability Tsunami, Part 1: When Governments Switch Off Their Own Websites. One Flaw Behind Seven in Ten Websites – and Anthropic's Security Deputy Says It Gets Worse","html":"<iframe width=\"100%\" height=\"180\" frameborder=\"no\" scrolling=\"no\" seamless src=\"https://share.transistor.fm/e/6ebe6f2d\"></iframe>","width":"100%","height":180,"duration":3139,"description":"Imagine you work for a government, and your job is to make sure people can get things done online. Then one Wednesday you do the one thing your job was supposed to prevent: you switch off your own website. Nobody has broken in yet. You just know someone could.\n\nPart 1 of an AI Drama double. On 21 October 2026, governments on several continents closed their own digital doors as a precaution. The reason: critical flaws in PHP, the engine behind roughly seven in ten websites whose server language can be identified. They were found with frontier AI models and can be exploited remotely, without a password. And Anthropic's deputy security chief says it gets worse before it gets better.\n\nIn this episode:\n🚨 Governments flip the switch (00:49) — the Dutch cybersecurity centre takes its own site offline, DigiD's website goes dark, a minister in the House of Lords lists 32 unavailable government services, Offenbach pulls three systems, and Latvia does it differently: it closes the border for its websites. Meanwhile, at most companies, nothing happens.\n🏨 You just want to book a room (07:08) — kids on holiday, a hotel with a heated pool, and the booking that doesn't work. What PHP actually is, why WordPress, Drupal, Joomla and TYPO3 all sit on it, and why \"it's only our website\" is the wrong first reaction.\n🕵️ The stranger behind the reception desk (12:43) — remote code execution, out-of-memory corruption and use-after-free, explained with a hotel front desk, a full desk and drawer number 12. Why the damage depends on how many keys your web services hold, and why \"we're behind Cloudflare\" doesn't make you safe.\n🔍 The bug was old. The proof changed everything. (19:12) — the first warning signs came in a 2024 audit. Then Ryan Austin of Calif, working under OpenAI's \"Patch the Planet\" programme with GPT-5.6 Sol, and separately the cloud security firm Wiz, proved it could be exploited. The White House and US agencies were informed. And a thought experiment: what would you do if...","thumbnail_url":"https://img.transistorcdn.com/K89WOul5lFP6eyTkepgc48DwnmOLDjvzPf-VdoMUwqc/rs:fill:0:0:1/w:400/h:400/q:60/mb:500000/aHR0cHM6Ly9pbWct/dXBsb2FkLXByb2R1/Y3Rpb24udHJhbnNp/c3Rvci5mbS84Y2I2/YTZiNWNmNGE5NmYy/NzE4ZTAyMTYxYjNh/ZmM5Zi5qcGc.webp","thumbnail_width":300,"thumbnail_height":300}