Feed aggregator

Two Catholic bishops have expressed intense regret at their recent photo op with President Trump, calling the widely-circulated images of their White House meeting an exploitative act that was “publicized by the administration without the consent of the participants.”

“The meeting was in no way an endorsement of the president, his policies, or his party.... We were told the meeting was to be a private discussion, that several Catholic members of the cabinet might make an appearance, and that there could be an opportunity to pray privately with the president,” Milwaukee Archbishop Jeffrey Grob wrote Sunday in a statement titled “A Public Apology.”

“We were then directed to stand behind him and pray. After which several photos were taken and we were ushered out. Unbeknownst to the group of bishops a video was also taken. But permission for the public distribution or posting of either the video or photos was not given by the bishops,” Grob continued. “It did not take long thereafter for the White House to post a video and photos of the prayer. I soon began receiving messages of serious concern over the possibility that I had inadvertently participated in a political event less than two weeks before a national election. I also heard from some who felt wounded because of the ways they or their family had been harmed by the president’s policies.”

Iowa Bishop William Joensen expressed similar sentiments.

“I wish I had been more shrewd and less simple, like those who exploited our meeting for partisan political purpose,” he wrote. “I pray I am more prudent and wise going forward, even as I remain resolute in my openness to engaging and praying for political leaders at all levels.”

Catholic Archbishops and Bishops pray with President Trump in the Oval Office ❤️ https://t.co/facV5wTGQQ

— Margo Martin (@MargoMartin47) October 22, 2026

The White House meeting was organized by the ultra-conservative Heritage Foundation. And Trump is about as pious as his policies (not very). This made the images from the meeting and the shady nature in which it unfolded all the more questionable—and regrettable—for some of the clergymen involved.

“I feel a heavy sadness, not only over the pain I caused, but also for the fact that something so sacred to a group of religious leaders, prayer to our Heavenly Father, would be manipulated in that way,” Grob continued. “We came in good faith to try to work for the betterment of our fellow human beings, to ease their suffering, to build up the common good, and to pray with a president, not to pose for a political photo opportunity to benefit the few. We should never have been put in that position by the White House.”

The number of polls has dwindled in this last week and change ahead of November’s midterm elections. As such, a sort of cabin fever has fallen over the online political world as pundits, operatives, and assorted political junkies desperately search for something—anything—to obsess over while waiting for Election Day. For Republicans, there’s an added desperation to change the political…

Source

This Thursday, 29 October, The Register hosts HPE and NVIDIA at one dinner table in Washington to answer the question that stalls AI in regulated industries: where the data lives, who can reach it, and what an auditor will accept as evidence a year from now. The table is nearly set. If you have been meaning to ask for a place, this is the week.

Editor-in-chief Matt Rosoff chairs. HPE sends Bharath Ramesh, Head of Product, AI Factory Solutions, and Tracy Mills, Acting Director Federal Systems Integrators and Distinguished Chief Technologist Federal. NVIDIA sends Bert Condensa, Vice President for Enterprise AI Factory Segment Sales. They are there to take questions, with no slides and no recording, and the chair stops a pitch before it starts.

The evening runs under the Chatham House Rule. That is the point of it. The things worth knowing about sovereign AI infrastructure, such as what a bank had to rebuild or which option somebody paid for and would not buy again, get said at a table like this and nowhere else.

The agenda: which infrastructure options hold a boundary, what each one costs, and whether any of it survives production.

The seats are for technology, data and risk leaders in healthcare, financial services, research, pharmaceuticals, government and higher education. Dinner runs from 6.00pm to 8.30pm at Fiola Mare, Washington DC. Places go by invitation and the last of them are going now.

Request one here.

Government and public sector guests: where your agency’s ethics rules require it, you can pay your own share and we will provide a receipt. Please say so when you request an invitation.

View the live blog on Daily Kos.

Source

NASA's Swift observatory made its final observation on October 20 and is expected to re-enter the atmosphere in the next few weeks after a failed rescue attempt over the summer.

Designed to study gamma-ray bursts, Swift was launched on November 20, 2004, on a two-year mission. It has lasted almost 22 years, but atmospheric drag is inexorably lowering the spacecraft's orbit, so reentry is likely just shy of the vehicle's 22nd anniversary. Swift has no propulsion system to save itself.

Swift is now orbiting at an altitude of less than 171 miles above Earth's surface, meaning it cannot keep its telescopes steady when pointing at astronomical targets.

Because the spacecraft could no longer compensate for the increased drag, it dropped into safe mode. A command was then sent from the ground that, according to NASA, "effectively ended Swift operations to prepare it for re-entry."

The descent of Swift has accelerated in recent years due to increased solar activity. Last year, NASA awarded Katalyst Space a contract for a high-risk, high-reward mission to boost the observatory to a higher orbit. Swift's science operations were curtailed to maximize opportunities for Katalyst Space's LINK spacecraft, but alas, a rendezvous never happened, and engineers opted to reactivate operations to eke out as much science as possible.

The expected side effect was increased drag on the spacecraft and, as expected, Swift sank rapidly until operations had to cease.

Swift has been an astonishingly productive instrument during its long life. According to NASA, it has observed more than 2,000 gamma-ray bursts and more than 1,400 supernova explosions. It has conducted an all-sky X-ray survey and seen stars shredded by black holes.

The full Swift archive comes to approximately 12 terabytes. Not too bad for something that was only supposed to last two years.

NASA now faces the problem that it has no direct replacement for Swift. As well as paying tribute to the observatory's contributions, Shawn Domagal-Goldman, director of the Astrophysics Division at NASA Headquarters in Washington, said in a statement:

"To support rapid response to cosmic events in a post-Swift world, we're exploring our ability to use and augment NASA's fleet of existing space telescopes, from fast-to-orbit commercial capabilities to efficient, innovative new missions." ®

Anthropic has officially filed for an IPO, revealing soaring revenue, mounting losses, major enterprise adoption, and an unusual governance structure designed to preserve founder control and its AI safety mission.

Anthropic’s Claude got around a paywall to access Georgia voters’ data without human authorization.

Anthropic confirmed to Axios Sunday that the company’s artificial intelligence model had, without prompting, requested a digital entry pass, or “access token,” to collect aggregate vote counts for a statistics project.

“Claude did not access the state’s voter registration system, change any voting records, or pull any individual voter records,” Anthropic said, adding that it had placed guardrails to prevent the chatbot from taking these sorts of actions in the future.

The company first notified the Georgia secretary of state’s office and the White House three weeks ago about the spontaneous access. Trump administration officials urged the state office to disclose the incident, but those calls went unheeded, a source told Axios.

This revelation comes as Anthropic unveiled its Initial Public Offering filing Monday, ahead of what is expected to be one of the largest stock debuts in history at an estimated value of more than $2 trillion. It also comes weeks after one of its researchers warned that the company’s product could cause a mass extinction event.

This is just the latest instance of an AI company being forced to disclose its model’s unauthorized behavior.

Democrats just dropped a heavy hammer on the president, eight days out from Election Day.

House Judiciary Committee Democrats released a 50-page report Monday morning accusing Donald Trump of participating in Jeffrey Epstein’s criminal sex schemes. The caucus also accused the Trump administration of a broad cover-up, designed to shield the president from blowback as it tried to roll out the release of the Epstein files to the general public.

The report cites the experiences of 11 women, FBI records, and documents released through the Epstein Files Transparency Act. At least five women accused Trump of rape or sexual assault in Epstein’s company, according to interviews conducted by the committee. Others said there were “apparent attempts” by Epstein and his longtime girlfriend and associate Ghislaine Maxwell to traffic them to the real estate magnate.

Beatrice Keul told lawmakers that Trump “violently raped” her at a November 1993 pageant at the Plaza Hotel. She further described the beauty pageants as a “hunting ground” that Epstein and Trump would use to find and “prey” on young women and girls. Jill Harth also shared an account of a party at Mar-a-Lago in 1994, where she said Trump aggressively pursued and sexually assaulted her. Trump and Epstein were the only men present, Harth told lawmakers.

In total, at least 28 women have accused Trump of rape or sexual misconduct.

The report concludes that Trump and Paolo Zampolli, a former modeling agent and longtime friend of the president as well as a former senior Trump administration official, “may have been co-conspirators” in Epstein’s sex trafficking ring in the 1990s.

The report also claims that Trump’s Justice Department deliberately or prematurely shut down investigations into Trump-related allegations made by some Epstein survivors. It also accuses Attorney General Todd Blanche of specifically instructing Maxwell not to discuss a survivor whose account implicated the president.

“Trump’s Justice Department appears to be covering up these crimes to protect the President,” said Judiciary Committee ranking member Jamie Raskin in a statement. “The women who survived Epstein deserve to be heard, Congress must have the complete files required by law, and an independent special counsel must investigate Epstein’s co-conspirators and DOJ’s cover-up and ensure that state and foreign prosecutors have the evidence they need to pursue justice.”

Last week, reports emerged that White House officials were involved in drafting the infamous July 2025 FBI-DOJ memo that effectively shut down future Epstein-related investigations. The memo created explosive public backlash even among MAGA supporters for declaring at the time that there was no Epstein “client list,” no punishable co-conspirators to the pedophile’s crimes, and no grounds for further investigation.

The new iPad mini features a thinner and lighter design than its predecessor.

Secretary of Defense Pete Hegseth thinks a Senate seat would help him avoid impeachment or President Trump giving him the axe.

Puck reports that Hegseth is hoping that Tennessee’s incumbent Senator Marsha Blackburn wins her election for governor next week and appoints him to fill her vacant seat. Hegseth lived in Tennessee for three years before Trump appointed him to the Cabinet. On October 17, Hegseth was spotted at a University of Tennessee football game seated next to Blackburn and Republican Representative Tim Burchett.

Hegseth’s tenure has earned him both Republican and Democratic critics. He has fired or pushed out multiple senior military leaders, endangered U.S. troops with the “Signalgate” group chat scandal, and burned through missile stockpiles in the war with Iran. Outgoing Republican Representative Thomas Massie has led calls for his impeachment, which forced House Speaker Mike Johnson to dismiss the House early to avoid embarrassment.

Last week, The Telegraph reported that current and former Pentagon officials are ready and willing to “spill their guts” if Congress moves to investigate and impeach Hegseth.

“There’s going to be a lot of people that are going to very quietly go to the chair of the Armed [Services] Committee and are going to spill their guts, provide them with everything they can and leak everything they can,” an anonymous source told the British newspaper. “It’ll be horrendous. It’ll be consistent embarrassment.”

The Pentagon denies that Hegseth is seeking such an escape.

“Under President Trump’s leadership, Secretary Hegseth’s singular priority is leading the War Department and delivering on the President’s America First agenda,” Pentagon Press Secretary Kingsley Wilson told The Independent.

Hegseth’s plan might run into resistance, as Burchett is also eyeing the seat, and has spent much of the year campaigning for Blackburn. With Trump’s unpopularity shattering presidential records and next week’s midterm results looking worse and worse, it’s only natural that the rats will want to start fleeing the ship. Will Republicans look to protect Hegseth, or leave him to his fate?

Matiks has introduced a new platform for users to create games using AI.

President Trump doesn’t give a damn how much it costs to fill your gas tank—as long as he and his friends are making a fortune.

The president literally admitted this to thousands of people at a Georgia rally on Saturday.

“And while oil prices are temporarily high, and will be falling dramatically in a short period of time as soon as that war is over—because there’s so much oil,” he said to the crowd, “The United States oil and gas business is making hundreds of billions of dollars.... Our country is making hundreds of billions of dollars ‘cause of what’s happened in the Middle East.… trillions of dollars.”

Trump went on to tell the crowd that his team advised him to avoid talking about gas prices in that manner due to how incredibly tone deaf it sounds.

“My people said ‘please don’t mention that sir, because people are paying a little higher,’” he said in a whiny little voice. “That number’s gonna come way down, but what we’ve done for this country, we’re making money like this country has never made before. So I said let me say it gingerly.... I can just see the fake headlines: ‘President Trump is talking about all the money they’re making while people are suffering at the pump.’ That’ll be the headline. I said I don’t give a damn I’m gonna say it: We’re making a freaking fortune.”

Trump and his Big Oil friends are making a “freaking fortune,” not the normal Americans he’s trying to convince to vote Republican next month. But of course the most corrupt president of the century would have no issue conflating the profit margins of billionaires with the financial status of the average American—even as there is a negative correlation between the two. His comment was lambasted far and wide.

“Trump just said the quiet part out loud: He doesn’t ‘give a damn’ about higher gas prices, as long as his billionaire friends are making a fortune,” independent democratic socialist Senator Bernie Sanders wrote online. “Trump doesn’t tell the truth very often, but he did last night!”

“Donald Trump has made $2.2 billion off the presidency—and counting,” Illinois Democratic Governor and 2028 presidential hopeful JB Pritzker wrote. “The only person making a ‘fortune’ is him.”

“Give @POTUS credit for leveling with the American people. HE’s making money like he’s never made before,” CNN analyst David Axelrod added. “And he doesn’t give a damn about high gas prices. (Not a great closing message, though.)”

This is such a “let them eat cake moment” for the president, blatantly expressing his giddiness at his own personal financial windfall during a rally that was supposed to convince voters to support the same rich friends he bragged about. And when is that war on Iran actually going to end?

It’s been a while since Amazon billionaire Jeff Bezos and his bride Lauren Sanchez-Bezos made headlines, but that doesn’t mean they’re just hiding away in a prolonged state of honeymoon bliss. And what they’ve been up to is riddled with irony. As it turns out, the Mr. and Mrs. have been playing the role of environmentalists at the United Nations’ COP17 biodiversity conference this past week…

Source

AI has yet to deliver any financial payoff to US businesses outside of the tech sector, according to investment biz Apollo Global Management.

The global asset firm made the claim in a posting to its Daily Spark blog that features analysis on the US economy and capital markets. It says corporate America is starting to view token spending not as a source of growth, but rather as a cost center that weighs on company margins.

Apollo’s chief economist Torsten Slok says that revenue per worker may be rising for the so-called "Magnificent Seven" tech firms, which includes the hyperscalers plus Apple, Nvidia and Tesla, but this isn't the case for the rest of the S&P 500 businesses.

The same goes for profit margins, and for AI boosting corporate productivity growth, he adds, posting charts to back up these claims.

Apollo's assertion has met with pushback from some, who commented on social media that they did not recognize the picture painted by Slok. Others said a similar effect was noted in the PC industry, when productivity growth lagged the widespread adoption of computers in business by a decade or more.

However the investment firm’s observations chime with various reports The Register has analyzed over the past year or two, such as one earlier this year from PwC that found the majority of chief executives had enjoyed neither increased revenue nor decreased costs from AI, despite investing heavily in the technology.

Research from professional services firm Deloitte also showed that adopting AI tools has not helped the bottom line for most companies, while a separate report found AI is now facing corporate accountability after several years of investment with little or no return, and projects will have to prove their worth or be axed.

McKinsey reckons the corporate world is now at a turning point and on the road to seeing a return for all the effort that organizations have put into pilots and early AI deployments – although it concedes the number of businesses reporting an actual earnings boost from their AI initiatives has remained flat.

Slok questions whether mainstream corporations will ever be able to turn AI projects into higher revenue growth and higher profit margins, despite the appearance of cheaper or open-sourced models.

In business, intelligence is mostly judgment, he says, and therefore depends on context. He notes that AI does not really understand anything, but especially accountability, trust, culture, unwritten rules, ethical trade-offs or fairness, all of which shape companies' reputational risk and ultimately drive revenue growth and profit margins.

Apollo also notes a slowdown in token spending growth, claiming this shows the spending is highly price-sensitive and demand falls away or switches to cheap open source alternatives in response to even modest increases in cost. This casts doubt over the economics of pouring billions into constructing ever more datacenters if the resulting compute is only likely to turn a marginal profit.

The investment biz previously handed $11 billion to Intel in exchange for a 49 percent stake in the chipmaker’s Fab 34 manufacturing plant at Leixlip in Ireland. Intel repurchased Apollo’s stake earlier this year for $14.2 billion after the chipmaker had put itself back on firmer financial ground. ®

Quick Take

• Eric Bauza, the modern-day voice of Bugs Bunny, Daffy Duck, and many other Looney Tunes characters, died suddenly at 46.
• The immensely talented Bauza voiced hundreds of characters, including some of the most famous, in a wide-ranging career covering many major IPs.
• The Los Angeles County Medical Examiner has since revealed Bauza died from hypertensive cardiovascular disease.

Eric Bauza, one of the most talented performers in the history of animation, and the man who voiced many Looney Tunes characters for a generation, including Bugs Bunny and Daffy Duck, has passed away suddenly. He was 46.

View this post on Instagram

Bauza’s family shared the sad news of his death on social media, writing:

Eric Bauza, Emmy Award-winning voice actor and the modern voice of iconic Looney Tunes characters Bugs Bunny and Daffy Duck, along with dozens of other beloved cartoon characters, has passed away suddenly. More details to come.

The Los Angeles County Medical Examiner has since revealed Bauza died from hypertensive cardiovascular disease. The day before his passing Bauza shared photos of himself from the LightBox Expo at the Pasadena Convention Center in California.

For those who aren’t aware, the late Bauza served as the primary voice for many iconic modern Looney Tunes characters. That includes voicing Bugs Bunny, Daffy Duck, Porky Pig, Tweety, Marvin the Martian, and Woody Woodpecker. He recently played many of them in both The Day the Earth Blew Up and Coyote vs. Acme. Just some of his other noteworthy credits, which span some of the most beloved animated characters and properties in history, include playing Puss in Boots, Splinter, Leonardo, Fozzie Bear, Stimpy, Flash, Mr. Freeze, Bane, Commissioner Gordon, Jimmy Olsen, Two-Face, Diddy Kong, Thunderbolt Ross, and Luke Skywalker. Bauza’s death is a tremendous loss to so many.

Zach Sang Show

Bauza was born in Toronto in the Scarborough district on December 7, 1979. During his career, he won three Children’s and Family Emmy Awards. The first came in 2022 for Outstanding Voice Performance in an Animated Program. The next year he took home a win for Outstanding Voice Performance in a Preschool Program. And in 2025 Outstanding Voice Performer in a Children’s or Young Teen Program for Teen Titans Go! He also earned six other Emmy nominations. But those accolades only hint at the breadth of his work and genius in what was ultimately far too short a career.

Warner Bros.

Bauza was an enormous talent who took tremendous joy in his work and sharing it with others. Though he died far too young, he leaves behind a legacy that exceeds his far too short years.

Mikey Walsh is a staff writer at Nerdist. You can follow Mikey on Bluesky at @‌burgermike. And also anywhere someone is ranking the Targaryen kings.

The post Eric Bauza Dead at 46, Voice of Bugs Bunny, Daffy Duck Gone Too Soon appeared first on Nerdist.

Attorney General Todd Blanche crashed and burned over the weekend while trying to defend the Justice Department’s lawsuit to block Alaska from certifying its Senate election results in the event that Republican incumbent Dan Sullivan loses due to voter “confusion.”

The lawsuit alleges that the Senate election should be nullified if Sullivan loses because there’s another “Daniel J. Sullivan Jr.” on the ballot also running as a Republican, and the Trump administration thinks voters will be too confused. Alaska’s Supreme Court in June upheld lower court rulings that found the two Sullivans could run in the same election—but the Trump administration has waited until just days before the election to intervene.

Appearing on CBS News’s Face the Nation Sunday, Blanche threw a tantrum as host Margaret Brennan showed that Sullivan was clearly listed as the “(Registered Republican) Incumbent” on Alaska’s ballot.

“I mean you’re not telling the truth, you’re not being honest with the voters!” Blanche whined.

Donald Trump has already admitted that he was the one who ordered the lawsuit, but Blanche refused to provide any details. “Who did he tell to do it?” Brennan pressed.

“So, I don’t—I will never, ever, ever talk about communications that I have with the president of the United States. I never have and I never will,” Blanche said.

Brennan read from the lawsuit that the DOJ had asked that Alaska’s state elections board and ballot counting review board “not certify an election result that may be impacted by voter confusion.”

“The confusion is defined as ‘Senator Sullivan not winning,’ and ‘had all votes cast for Daniel J Sullivan been cast instead for Senator Sullivan then he would’ve won,’” she said, leaving a lengthy pause for Blanche to respond.

“Well, that’s not what it says,” Blanche said.

“I’m quoting from it,” she said. “You are telling them not to certify it. What right does the federal government have telling a state not to certify or how to certify?”

“You know if you talk the whole time, you’re not going to get answers out of me!” he fumed.

Blanche didn’t fare much better during an appearance on CNN’s State of the Union Saturday. Host Dana Bash quoted Trump’s claim that “the Democrats are trying to steal this important Republican seat.”

“He’s admitting it’s political. Do you see your job as helping Republicans keep this seat?” Bash asked.

“He’s not admitting it’s political!” Blanche cried. “Wait, you’re saying that a president saying that there’s something improper happening at the ballots is necessarily political? He’s the executive, he’s supposed to make sure that everything in this country is running right!”

Blanche raged that Democrats were “cheating” and Bash had “cherry-picked” that quote.

He finally exploded after Bash suggested that there were concerns that Trump was laying the groundwork to overturn the election, like “what we saw after January 6.”

“I mean oh, stop it!” Blanche shrieked. “Oh you gotta stop it with that. You’re not being a real person! Come on, man! That is crazy!”

Surely, when your arguments become that the other side is simply crazy, that’s how you know you’ve got a winning lawsuit. Clearly, Blanche has veered into unknown territory: It is extremely abnormal for the Justice Department to be involved in election certification. But that won’t stop the Trump administration’s most blatant effort so far to swing ballots in Republicans’ favor.

President Luiz Inácio Lula da Silva’s decisive victory in Brazil’s presidential elections Sunday was already being disputed by his far-right challenger Flávio Bolsonaro as results were coming in.

Bolsonaro, the son of imprisoned former President Jair Bolsonaro, said that the results of the runoff election should be annulled because of a Brazilian Supreme Court ruling extending voting by two hours. However, both Lula and Bolsonaro’s parties had called for that extension, making his point moot. (The Supreme Court only ruled on Lula’s petition, though the requests were the same.)

Lula’s left-wing Workers’ Party supported the extension because voters in urban São Paulo and Bahia, where they have a strong support base, had trouble getting to the polls due to trouble with bus services. Bolsonaro’s Liberal Party, meanwhile, cited heavy rains in the southern parts of Brazil, where their supporters are more numerous.

Bolsonaro’s complaint is not likely to sway the Supreme Court. The high court’s president Kassio Nunes Marques, who was appointed by the elder Bolsonaro, confirmed the election result, noting that extending times did not affect the electoral process or the vote count. Lula won 51.79 percent to Bolsonaro’s 48.21 percent, a difference of 4.4 million votes.

U.S. President Donald Trump had pushed for Bolsonaro’s party to win, having supported Jair Bolsonaro during his tenure and disputed his prison sentence over attempting to overturn Brazil’s elections in an attempted coup d’état in 2022. Trump has not yet commented on the result, but his son Donald Trump Jr. did on X Sunday night.

Complaining about Brazil’s Supreme Court, Trump Jr. posted that “if a conservative government in Brazil did this, everyone in the mainstream press in America would lose their minds, but I guess they’re just choosing to be silent because it’s all for the cause.” Perhaps he’s just mad that Brazilians have done what Americans failed to do: lock up a corrupt far-right leader and keep him from returning to power.

We've spent the past several decades using duct tape, string, and chewing gum to chain the world's computers together into this thing we call the internet, so there's really no good reason to be surprised that most of it is full of software containing vulnerabilities that are practically just as old.

You can listen to the latest episode of The Kettle right here on this page, as well as on Spotify, Apple Music, or YouTube. Those platforms also let you subscribe to Kettle, so you are always notified when the latest episode goes live.

The world is still reeling from the PHP2Shell revelations that hit the news cycle this week, and on The Kettle there's no better topic for host Brandon Vigliarolo, cybersecurity editor Jessica Lyons, and FOSS reporter Liam Proven to tease apart.

Join us to discuss what exactly is going on, how AI was key to finding another issue no human likely ever would have discovered on their own, and why exposing more bad code in the backbone of the world's computers might be just what we need to rethink the whole thing for the better.

A lightly edited transcript follows:

Brandon (00:01)

Hi everyone, and welcome to the latest episode of The Register's Kettle podcast. I'm your host, Reg reporter Brandon Vigliarolo. And hey, there's only one thing we could focus on for this week's episode, given all the hubbub around it, and that's the PHP apocalypse. It turns out most of the internet is running software that could allow remote code execution on host systems via a pair, or as of today apparently three, vulnerabilities that have come to collectively be known as PHP2Shell. So that's not great. With me to talk about this is our security editor Jessica Lyons and open source reporter Liam Proven, who has a few things to say about PHP itself and why it's probably not surprising we're finding ourselves in this mess. Thanks to you both for coming on.

Liam Proven (00:43)

Absolute pleasure.

Jessica Lyons (00:43)

Nice to be here.

Brandon (00:44)

So Jess, let's start with the basics. What is this? How big of a problem is it? And where do we stand on getting things fixed?

Jessica Lyons (00:51)

Great. The short answer is it's a very big problem. So we have these two related memory safety vulnerabilities, and they are in the PHP core. Collectively they're called PHP2Shell, and they affect every version that's been released in the last decade affected by one or both of these, going back to about version 5.4. So the general consensus is this is about 70 percent of all of the websites on the internet are running this code. So it basically affects everyone at this point.

What happened here is that this dates actually back to August. An independent researcher first spotted this, and then we can talk a little bit more later about who found more of the exploits and what the (PHP) Foundation did with that. But so he found this vulnerability. There was a coordinated disclosure process with the PHP Foundation, and then that broke a little bit starting over the weekend, and then onto Monday, there were some leaks. There was a video posted that purported to show this exploit. And so we get this emergency warning from the PHP Foundation late Monday saying, "Hey, we are going to be releasing these emergency patches, so everybody get ready so you can implement them as soon as possible. It's very serious." So by Wednesday, they did release these, and there's this mass attempt to patch before any of the attackers get a hold of this and are able to attack websites with it. And one of the issues too is that some websites are running really, really old versions and so they aren't able to patch. So they're just sitting there, these legacy servers are still vulnerable.

Brandon (02:52)

So there's no direct update path for those old versions, right? It's basically shut this down and reinstall it kind of thing.

Jessica Lyons (02:59)

Exactly. So basically they're both these memory corruption vulnerabilities and by exploiting them, an attacker can kind of shape the memory that PHP trusts. And then they can use that to hijack what happens next. And that can mean remote code execution. They can take over the websites, they can steal data. And so people are visiting these websites they trust and they don't realize that the underlying code is stealing their data or delivering malware to their computer. And again, this is potentially 70 percent of the internet. So it's a big deal.

Brandon (03:36)

Quite a few sites were offline. I know even some big services. I stopped playing because I had a baby, but I used to play Final Fantasy XIV pretty religiously. And I know that the entire login server was offline a couple days ago

Jessica Lyons (03:50)

Right.

Brandon (03:50)

They were like, "You've got to fix this. Sorry, no one can play the game. If you're not logged in right now, you're not getting logged in for the foreseeable future." It's just insane how much of the internet was affected by this. Now It's under exploit, is that correct? But maybe not successfully exploited yet?

Jessica Lyons (04:11)

Right. So after the patches were released on Wednesday, later Wednesday, AWS came out and said, "We've seen exploitation attempts at least four days before the patches were released." So that kind of caused another frenzy that, "My God, it's under attack, the whole internet is on fire." There haven't been any successful attacks to date. There's been a ton of attempts.

There's a lot of POCs; some work, some don't. But as of Friday, according to the Foundation and according to all of the security experts that I've spoken to, we haven't seen any evidence of successful exploitation. I don't think that means we're in the clear. I think it just means it's taking a while for people – and honestly AIs – to develop successful attacks, but that's where we are right now.

Brandon (05:06)

Because it's a complicated attack chain, correct?

Jessica Lyons (05:10)

Right. Yes.

Brandon (05:11)

So basically, right. This is not working yet, but especially with some of these older websites that are running older versions of PHP that are going to have to take a more thorough approach to getting this fixed and possibly going down for some time, this could be one of those problems that remains serious for a while. And let's not forget, 70 percent of the websites on the internet, that's almost three-quarters of the entire internet. I don't know how many hundreds of thousands or millions of sites that is, but some of those are probably never going to get patched.

Jessica Lyons (05:41)

Right. Exactly.

Brandon (05:43)

Just the way it goes. Right. This is going to be the sort of thing that we end up hearing about months or years from now.

Jessica Lyons (05:49)

I would say years.

Brandon (05:53)

I'm sure there'll be some bank somewhere that eventually ends up getting – we'll hear about some breach disclosure letter from the state of Maine in four or five years.

Jessica Lyons (06:02)

And local governments, federal and state governments, I think these are the ones that we're going to be hearing about quite a while from now.

Brandon (06:09)

Because that's one of the things I was thinking about even for me in my tiny little town in northern Michigan. I wonder if my township or the county is going to be all over it to update their PHP server. Does their IT guy, who probably is a retired dude who lives in the area, even know this is a problem? It really is one of those things that is a big deal, but if you're not kind of following the news on this, it could probably go completely unnoticed. And for many websites, I'm sure it will.

Jessica Lyons (06:37)

Right. Exactly.

Brandon (06:37)

So, it's pretty crazy. Liam, you're working on a story, I think, as we are recording this, about some of the history of PHP and how it really probably wasn't very well designed or intended to become so ubiquitous on the internet. What's going on there?

Liam Proven (06:53)

I've seen one angle on this, which is people saying, "This is 1990s code and it has 1990s problems," which is one way to look at it. But I'm a 1980s internet guy; that's when I started exploring it. My primary email address is older than the web, and it still works.

My gods, it gets a lot of spam, but it still works. I've watched the rise and rise of PHP since the first releases. Now, I have no personal interest in web development. I can program, but I don't because I'm really bad at it and nobody needs to have my code inflicted upon them. The guy that wrote PHP in the first place, Rasmus Lerdorf, is my age. I've never met him; I'm sure he's a nice guy. But he said in a very early interview about it, "I really don't like programming. I built this tool to program less so that I could just reuse code." And that was about 1993. He built a little tool that allowed him to put macros in HTML for his own website, and it's just grown. In a later interview, he said something along the lines of, "I don't know anything about writing programming languages. I'm just improvising this as I go and people seem to like it."

It originally stood for "Personal Home Page," I think, and later was given a recursive acronym of "PHP: Hypertext Preprocessor." This is a programming language that you mix in with the HTML of a website. It predates the modern model of building websites where a database contains the text and a content management system of some kind assembles on the fly the pages that each person sees. This is an older model where you're running programs that are part of the markup language, which was not a good idea, but that was how he did it.

There was a lovely blog post. I've got an old friend who's an extremely skilled and talented programmer who has built a career on PHP, and he said to me, "Look, those criticisms that you've mentioned are of the really early versions and it's changed now." And if he hears this, he's going to be cross with me. But my favorite summary was from a blog called Eev.ee way back when that called PHP "a fractal of bad design."

Whatever level you look at it, it was done badly. If you look at the whole plan of "let's just intermingle program code in with the markup language," not a good idea. If you look at the details of how it was implemented, not a good idea. If you look down at low-level details of how the functions return values, not a good idea: inconsistent syntax, inconsistent functions, functions that do really weird things, by default no stack traces, not great error reporting.

Now, I'm sure a lot of this has been papered over now, but really there is one reason PHP is still around and still so big: Zuck. Facebook was built in PHP. And Facebook makes lots and lots of money and it's been throwing money at making PHP faster and more reliable and more scalable for decades.

Brandon (11:03)
Have they been big contributors to it?

Liam (11:06)
Yeah. They even built a compiler for it, which I suspect is still in use. Now, how much of Facebook today is in PHP? I don't know, possibly none, but for a long time basically the world's biggest and busiest public-facing website that wasn't owned by Google – only because Google have failed to ever make a successful social network – was built on PHP. And it's big, it's complicated. Like Linux itself, nobody fully understands how the whole thing works anymore and hasn't probably for decades.

And now people have got bots that they can throw against it and ask them to analyze it. I think this is probably just the first, and I think there's going to be many more. A friend of mine who's a senior developer had a look at the patch, and he's not a C guy, but he said – I'm quoting from comments on Mastodon – that the patch to the current version is 13,000 lines of C. That's a doozy of a patch.

Brandon (12:17)

That's huge.

Liam Proven (12:20)

A bunch of people have been working like crazy for quite some time. Some people who've looked at this say it looks handwritten to me. Others have said, "No, I think this is bot-generated." I think the truth is probably a bit of both: some from one, some from the other.

Brandon (12:32)

Bit of both. I mean, you can't pump out thirteen thousand lines that quickly and have it tested. God, I hope they tested it.

Liam Proven (12:41)

Right. But that's just for the current version, and this hole affects every published version. So if they do manage to fix this one, how long till the next one comes along? Because I think there's going to be –

Brandon (12:56)

Especially with the speed at which vulnerabilities are being discovered now. I feel like every time I turn around, I've written one Patch Tuesday article in the past few months, and that one broke the previous two records. And I think since then every month has included more patches, and a lot of those are probably –

Jessica Lyons (13:14)

October at this point is the record: over a thousand for Microsoft alone. So, yep.

Brandon (13:21)

That's insane. Like you said, it is a fractal of bad design all the way down, and is going to probably have more vulnerabilities discovered.

Jessica Lyons (13:32)

Right.

Brandon (13:32)

Seventy percent of all websites on the internet are using this. What can we do? Are we stuck?

Liam Proven (13:35)

Well, there's a reason for that, and it's one that doesn't get talked about an awful lot: Facebook aren't the only people that use it extensively, because WordPress is also built on PHP, and it's far from alone. Another senior Linux techie friend of mine gave me a free shell account on the machine that he runs for a few friends years ago, and I thought of resurrecting my old 1990s hand-coded HTML webpage for fun. So I found it on the Internet Archive and found a tool to scrape it and turn it back into HTML again. I looked at some CMSes and asked him if there was any CMS on the machine.

He went, "No."

And I went, "Well, would you install one?"

He went, "No."

"Well, why not?"

He said, "Well, all the big ones are implemented in PHP, and I won't let that near any server I run."

"Well, that's a bit dramatic, isn't it?"

And he goes, "No, that's pragmatic. I run a bunch of public-facing servers on my own, and this is how I keep them secure. No containers, no Docker, no PHP, nothing built in any of these technologies."

And I went, "Wow, what about..."

So I went looking for non-PHP CMSes. There are a lot of CMSes out there. I got a commission about a decade ago to write a comparative assessment of the CMS market versus a company's proprietary Windows product. I went and did a survey and came back and said, "I've found 1,300 so far."

And they said, "OK, we can give you five thousand words instead of a thousand words."

And I said, "You realize I'm going to have to go and look at 1,300 pieces of software here. Even if I only write three or four words about each one, 'Mostly harmless,' I'm still going to have to look at over a thousand bits of software. It will take me a year."

And they went, "Well, how can how can we do it quicker?"

And I said, "You can't. I cannot do this survey you want. Give me a full-time job and I'll get it back to you in a couple of years' time."

I found a few CMSes that weren't built in PHP. Most of those were built in Ruby instead. And he went, "Yeah, I'm not keen on having that on my server either."

So it's not even a case of people that have PHP deployments needing to update. They don't know. They built it on something else which was built on something that was built in PHP.

Jessica Lyons (16:15)

I was just going to say, Liam, you said, "How long until the next one happens?" And we found out today from the PHP Foundation that there is a third one. They won't be pushing an emergency release for this. They said it'll be published with the next regular release cycle. The Foundation told me that this one, quote, "requires a very unlikely combination of configuration and specific PHP application code, which we do not expect to occur in practical use." So, there's already another one.

Liam Proven (16:45)

So weeks then.

Brandon (16:47)

Yeah.

Jessica Lyons (16:48)

I mean, and even with this, it's hard to exploit. You can mitigate it with a configuration setting. But that was part of the thing we've heard with these other two. And then we did have researchers yesterday who developed this new exploit; this was Vulncheck. And that shows how even ASLR can be bypassed to attack these vulnerabilities on x86 machines. So saying it can be fixed with a configuration setting isn't always a guarantee.

Brandon (17:25)

That brings me kind of to the elephant in the room of this whole story: AI. because of course it all comes back to AI nowadays. OpenAI and two other security firms reported this. I think Jess, one of your stories or one of the ones Lindsay wrote said that they all used AI to find this, right?

Jessica Lyons (17:49)

Right. So the companies: Calif, they are a newer startup doing AI pen testing and they're part of OpenAI's partner program, so they used OpenAI models working with OpenAI to find this. And then independently, Wiz, which is owned by Google, also did. So this happened back in August, and then they have been all working with the PHP Foundation on the patch since that point.

They have all said these are vulnerabilities that probably wouldn't have been found by humans alone. By all accounts, they've existed for decades and wouldn't have just been found by human researchers.

Brandon (18:34)

Right. So either these are things that have never been discovered and would have never been exploited theoretically – the exploit path is complex, they're not obvious vulnerabilities, so they needed an AI to find them – or perhaps this is the kind of thing that was known about but was privately held in the hands of some bug hunting company that sells exploits to governments. Who knows? Maybe that's the case. I remember talking to a guy one time at Black Hat who basically said his company's in the business of finding really sensitive vulnerabilities and then selling them to the highest bidder. So there are companies like that that exist. So there's probably plenty of vulnerabilities in software that are not well known that governments and high-level functions are aware of. But in this case, this probably wasn't the case. This is an incredibly difficult-to-find vulnerability.

I've seen a lot of chatter online in the past few days about how the internet's on fire and the AI bug-pocalypse has arrived. It seems like we're having another case of people getting all freaked out because this is the end of time, history is over, and AI is going to kill us all. It just seems to me like this is another example of: well, maybe not. This has been getting hammered by potentially bad actors or pen testers, and no one's managed, as far as we know, to successfully use this yet. Is this as serious as it seems, or is this another case of a serious vulnerability that is so complicated and convoluted that it's not really going to be that big of a deal?

Liam Proven (20:25)

I want to note parenthetically that you described OpenAI as a security company, and if I had been drinking coffee, that would have been very bad for my keyboard.

Brandon (20:32)

Okay, whoops. Let me take that back.

Jessica Lyons (20:31)

Ha ha ha.

Liam Proven (20:36)

Calif is interesting because I just wrote about them. They found a hole in OpenBSD, and there aren't many of those. And only about a week ago, they found a hole which they dubbed "Big Fish" in OpenBSD, and it was just days before OpenBSD 8 shipped. It looks like that had been there for 37 years, which is a neat trick because OpenBSD was founded 30 years ago. So this is in – going to pronounce this carefully – Berkeley Software Distribution Unix in the eighties. But there are doubtless more, and I'm an arch AI skeptic.

Some people will claim that this will be the sort of problem that you can solve with AI by getting it to rewrite your stack. Well yes, but then you'll replace it with a new stack that nobody ever understood any of. But there are ways to design, host, and run websites, forums, and chat channels without using any of this stuff. And it could be a net positive if holes like this keep getting found that people will be forced to go back to – sounds crazy, but – static websites serving pre-written code off a disk.

One of my favourite websites – recently I discovered there's a whole chain of them, and I hope you won't mind me swearing; maybe you have to beep me. But there's a marvellous website called "This Is a Motherfucking Website and It's Perfect." And recently somebody rewrote it and the new one looks almost identical: "This Is a Modern Motherfucking Website and It's Perfect." He's written it with more CSS or something, but apparently there's a whole chain of these things and they are extremely low on programming code. They contain interactive elements that you can do with just HTML, and you don't need a whole web framework behind it. And the same AI companies are busily scraping the whole web multiple times a day to feed their training engines. Maybe we just have to suck it up, scrape some of these big websites, and redo them as simpler tech with fewer interpreted languages. We are all collectively victims of the sunk cost fallacy. We've got millions of websites. We spent billions and trillions of dollars building all this. We can't just throw it all away. Well, maybe you have to.

Brandon (23:27)

Sunk cost was something that kept coming to my mind as I was writing up the script for this episode and just thinking about this. It seems like a whole big case of, "Well, all the websites in the world are now on PHP, so I guess we're stuck."

Liam Proven (23:42)

We have a script?

Brandon (23:46)

Well, not a formal script, just notes.

Liam Proven (23:48)

Haha. Well I didn't get the memo.

Jessica Lyons (23:50)

I think that's part of the problem though: it illustrates this larger issue with AI in general. AI bug hunting and exploit detection kind of illustrates this bigger problem about the internet, especially these legacy systems that underpin government services and critical infrastructure. It is literally held together by duct tape and string. So it's a massive problem. Again, it takes some work to actually make anything of these vulnerabilities and chain them together. AI is getting better at that. So whether or not this ends up being the end of the world for the internet as we know it, it does illustrate a real problem.

Brandon (24:42)

Like Liam said, maybe this is the sort of catalyst that the wider internet community needs to realize that these systems – this duct tape and string – simply won't keep working forever. We need to maybe modernize all the underlying infrastructure and make it simpler and less kludged together with all these different things over the years. PHP is poor design all the way down, right? It's like: well, maybe we need to tear it out and start over. Even if these vulnerabilities are impractical to exploit and hard to find, the fact that they're being discovered does illustrate that most of our code is a mess.

Liam Proven (25:28)

I am reminded , the other day I was talking in the comments about A/UX, Apple's original Unix for the Mac, and Apple paid another company to develop A/UX because the US military had a tick box on the form that said to buy systems, they have to be able to run POSIX. The US Army at one point hosted its website on Classic Mac OS. And it wasn't exactly security by obscurity. They said virtually all web server attacks in the mid-1990s were based on getting a remote shell, and Classic macOS didn't have a shell at all, anywhere. There was no way to get a remote shell because you couldn't get a shell if you were sitting in front of it. So they said, "They try and inject bits of x86 code: well, it's not an x86. They try and get a shell: it hasn't got one. They try and get it to run scripts: it doesn't run scripts." They said, "We just sit there and watch people throwing themselves at it. All the best attacks, and none of it works because the operating system's kind of too primitive to do any of that stuff." I don't believe many customers actually ever used A/UX, but it got Apple some lucrative deals. Maybe we're going to see a new trend of super primitive, super basic websites. There'll be a new difficulty in trying to scale the things because Kubernetes expects a lot of this to be dynamically generated by microservices. But bring it on; I'd love to see that.

Brandon (27:09)

That's a Kubernetes problem, right?

Liam Proven (27:12)

Yeah.

Brandon (27:14)

I feel like I would love a simpler internet. It would be amazing if I could just wake up in the morning, go to a news site, and just get the headlines. So often, I feel like – and I think The Register is good at having a relatively simple design, but – so often I feel like the news aggregators that I go to... I look for ones that are as minimal as possible. I look for websites that are simple. I don't need all this in-your-face stuff; it's not necessary. I think we probably are all pretty sick of it in a lot of ways.

Jessica Lyons (27:49)

But do we really think this is going to happen though?

Brandon (27:52)

No.

Jessica Lyons (27:53)

I feel extremely pessimistic about this. I think it's much more profitable to just keep marketing solutions to the problem as opposed to a safe coding overhaul.

Brandon (28:04)

Unfortunately.

Liam Proven (28:06)

Geopolitics might yet get in the way. I wrote a piece about OpenEuler, one of the big Chinese enterprise server Linuxes, and one of only two companies actually showing off an OS at the Open Source Summit. The other was also Chinese: OpenKylin, which is more desktop focused. China makes its own chips, China makes its own operating systems, and it's got its own programming languages. They're all open source, taken from European and American developed software by and large, but they could still invade Taiwan and cut off much of the world's chip supply. And suddenly it won't just be that memory is way more expensive than it used to be; it will be that you can't get more memory anymore and you have to keep using 10-year-old chips. And people will be potentially forced to find ways to keep getting more out of the same hardware until we can build new chip fabs, which will take a lot of time and a lot of money. And then quite possibly they'll get blown away in a climate-change-induced hurricane and then we'll have to start again. So, I hope they're going to start building them in the north of Norway and places like that. But yeah we've got bigger problems coming down the pipe and it's all a giant snowball of superficially unrelated things: AI attacks on overcomplicated stacks on one side, and the other kind of attack which involves whistling noises and large explosions on the other side, which cuts off the hardware market. It's hard to plan for this, but nobody's even trying yet.

Brandon (29:52)

Who would have thought a talk about a PHP vulnerability would have turned into geopolitical chaos and the endof modern technology as we know it? Break out the sundial, people.

Liam Proven (30:07)

Excuse me, I've just got to go and wind the web server. Hang on.

Brandon (30:11)

All right, guys. Thanks for coming on. I think this was a really valuable discussion and it shows just how interconnected all these issues in tech are right now. I mean, it is interesting how we're kind of hurtling toward something in a lot of ways. AI will surely be a part of it, as will expensive chips and lots and lots of vulnerabilities being found every day. Hopefully we'll still be here to cover it as that continues to happen.

Jessica Lyons (30:40)

If AI doesn't kill us.

Brandon (30:41)

Right. If AI doesn't kill us all. Well, if it doesn't, we'll be here on the Kettle to talk about it. And we hope that you, from whatever bunker you're hiding in, will join us on future episodes.

Liam Proven (30:53)

Yeah, we'll be publishing a telephone number so you can phone into future Kettle episodes.

Brandon (30:59)

All right, folks, we'll talk soon. ®

This post is updated throughout the day to reflect the latest incidents. It was last updated at 6:31 a.m..

Here’s what’s happening on the roads this morning…

▼︎ new incidents

Road incidents as of 6:30 a.m. on October 26

• A traffic break was requested by CHP to remove part of a deer from the #1 lane on northbound Highway 1 at Bay Porter in Capitola / Soquel. This was reported today.
   
• South Highway 1 at Park Avenue in Capitola / Soquel is facing closures because of paving work. The closure will last until Nov. 19.
   
• There will be alternating lane closures on both northbound and southbound Highway 9 at Pool Drive in San Lorenzo Valley because of bridge work. The closures will continue until April 30, 2027, at 6:59 a.m.
   

Disclosure: Traffic incidents are partially generated by artificial intelligence. We are constantly working to improve the accuracy and quality of our AI-generated content. However, there may still be errors or inaccuracies. If you have any questions or concerns, please contact us.

The post Monday morning traffic: Highway 1 closure at Park Ave.; lane closures on Hwy 9 appeared first on Lookout Santa Cruz.

In yet another sign that Democrats are poised to ride a tsunami into a larger-than-expected House majority, Republicans are unloading millions to try to save a new crop of districts—some of which weren’t even on the board of competitive seats a week ago. These races weren’t on anyone’s radar when the cycle began, as President Donald Trump won them by double digits in 2024. But as Trump’s…

Source