• A New Mexico judge ordered Meta to pay $25 billion over how it handled its users' data.
• It could be the largest penalty against Meta in history.
• Meta recently agreed to an $18 billion settlement over the impact of its tech on kids.

A judge in New Mexico ordered Meta to pay $25 billion for misleading users about how it handled their data and for failing to prevent misinformation on Facebook.

The ruling could be the largest penalty in Meta's history. Last month, Meta settled a child-safety lawsuit brought by a group of US states for $18 billion.

The New Mexico case focused on Meta's handling of user records that Cambridge Analytica used for campaign purposes during the 2016 election. New Mexico alleged that Facebook misrepresented the extent of users' control over their data on the app.

"Facebook's wrongdoing—over the course of years and systematically broadcast to the public—goes to the heart of Facebook's core business practices," Judge Francis J. Mathew wrote in the ruling. "It relates to the way in which Facebook induces people onto the platform and ultimately keeps them there."

In a statement, Meta's chief legal officer, C.J. Mahoney, said the penalty "makes it all but impossible to do business in the state of New Mexico."

"At its core, this lawsuit seeks to impose a tax on speech to enforce new rules for what people can say online," Mahoney said. "We are confident we will prevail on appeal."

A jury ruled against Meta last month, finding the company committed nearly 50 million violations of a New Mexico law prohibiting deceptive trade practices. Each violation carries a penalty of up to $5,000.

Some Meta executives, including CEO Mark Zuckerberg, were deposed in the case. New Mexico first sued the company in 2021, and the case went to trial last month.

In internal Meta communications presented at the trial, Zuckerberg appeared to obfuscate methods for users to hide their data.

"Give them a chance to change their privacy settings but obviously don't encourage it," Zuckerberg wrote in one internal message.

Meta's next move remains unclear. The company didn't immediately respond to a request for comment on Wednesday.

This is a breaking news story. It will be updated.

• The internet is ablaze after cybersecurity researchers using AI found a bug in the PHP programming language.
• Greg Brockman said bad actors could use the exploit to steal private user data.
• The FBI and NSA have advised people to either take down websites or update their software.

OpenAI said that 70% of the world's websites could be in peril after cybersecurity researchers using its AI models found exploits in a popular programming language.

The National Security Administration's cyber division advised all web providers that use PHP, a widely used open-source language, to take their systems offline or update their software after OpenAI said one of its models found two "critical" flaws in the language's infrastructure.

Greg Brockman, the president of OpenAI, said in an X post that hackers could exploit the vulnerability to steal private user data or modify websites.

"We consider this one of the most impactful security issues in recent memory," OpenAI said in a blog post.

While OpenAI said the vulnerabilities appear to have been identified before any attackers discovered them, the public disclosure set off a race for companies and governments to update their websites and apply fixes before hackers could exploit the bugs.

"We are seeing early attacks emerging and are updating mitigations as new vectors show up," Dane Knecht, Cloudflare's chief technology officer, said in a post on X.

Numerous websites, including those belonging to governments and the media, went offline on Wednesday to address the issue.

PHP is a popular programming language that often handles the behind-the-scenes work powering websites that require user logins and online orders.

The critical flaw was first identified by Calif, a cybersecurity research company using GPT-5.6 Sol. Wiz, another cybersecurity company, independently uncovered the issues, OpenAI said. The companies are part of an OpenAI-led initiative called "Patch the Planet," which aims to make the world's digital infrastructure more secure.

OpenAI has also warned that as cybersecurity researchers continue to probe software vulnerabilities using its ever-advancing frontier models, more security failures will emerge.

An engineer at Microsoft pointed out that the PHP vulnerability was discovered with an older model.

"I don't think the world is prepared for the sheer number of vulnerabilities newer models will uncover," the engineer, Nicolas Bustamante, said on X.

The public disclosure on Wednesday by OpenAI and others of the existence of the exploits triggered urgent messages from leaders worldwide, including the Japanese Prime Minister.

"We have an urgent request for everyone to take action tonight," said Sanae Takaichi.