The Trump administration has ordered non-emergency U.S. government employees and their families to leave Saudi Arabia as deadly Houthi attacks intensify across the kingdom, raising the stakes as President Donald Trump weighs direct military action against the Iran-backed group.
State Department spokesperson Tommy Pigott confirmed Wednesday that the mandatory departure order applies only to Saudi Arabia, pushing back on reports that Washington was preparing a broader evacuation of diplomatic personnel across the Gulf.
"The U.S. Department of State issued an ordered departure for non-emergency U.S. government employees and their family members in Saudi Arabia only," Pigott said.
The order comes amid a surge in Houthi missile and drone attacks that has left civilians dead, disrupted air travel and sent Saudi Arabia scrambling for additional missile defenses.
"Iranian-supported Houthis have increasingly engaged in hostilities against Saudi Arabia, including attacks on civilian airports and other critical infrastructure resulting in civilian casualties and severe travel disruptions," Pigott added.
President Donald Trump is weighing whether to launch direct U.S. military strikes against the Houthis, whose expanding missile and drone campaign has increasingly threatened Saudi cities, airports and energy infrastructure.
Houthi strikes and attempted strikes on Saudi Arabia more than doubled in a single week this month, according to the Armed Conflict Location & Event Data Project, with airports in Riyadh, Jizan, Najran, Dammam and Abha targeted since Oct. 5.
The deadliest barrage struck King Khalid International Airport in Riyadh, killing at least 13 people and wounding more than 300.
The escalating attacks have prompted Saudi Arabia to seek additional military support from its allies. Britain announced Tuesday that it would deploy Typhoon fighter jets to help defend Saudi cities and critical infrastructure, while Egypt is assisting the kingdom and Israel has offered to help.
Riyadh has also asked Washington for additional missile interceptors, though U.S. officials have warned that global demand is straining available supplies.
"I also talked to Saudi Arabia today; they'd like interceptors. Israel would like interceptors. We would like interceptors. Every country in the world would like interceptors," Secretary of State Marco Rubio said Tuesday.
Rubio described the weapons as "probably the most in-demand product right now in the defense field," acknowledging that the United States must balance requests from allies against its own military requirements.
The growing threat has exposed the difficulty of defending Saudi Arabia's vast territory against relatively inexpensive missiles and drones, even with some of the world's most sophisticated air defenses.
"Saudi Arabia is a huge geography to protect, and this speaks to a larger threat we're facing globally: a relatively small nonstate actor can pose a serious challenge to even a sophisticated and extremely expensive military," Farea Al-Muslimi, a research fellow at Chatham House, told Fox News Digital in an interview published Wednesday.
"The Houthis can impose enormous costs without having to spend very much themselves," he said.
Trump has left open the possibility of direct military intervention against the Houthis, telling reporters earlier this month that the U.S. could join Saudi strikes against the group.
"We may. We're gonna look at it," Trump said. "We'll make a decision. We move very quickly."
The U.S. conducted a roughly two-month bombing campaign against Houthi targets in Yemen in 2025 before Trump halted the operation following an Oman-brokered agreement.
The U.S. continues to provide intelligence and targeting support to Saudi Arabia as Trump weighs whether to launch another round of strikes against the Houthis.
France, Germany, Austria and Poland are expanding or reviewing the authority of critical infrastructure operators to defend facilities against drones, raising legal and operational questions over the growing role of civilian companies in national security.
European governments are reconsidering who should be authorised to intercept hostile drones as energy companies and critical infrastructure operators confront an increasingly serious threat to electricity networks, transport systems and other essential facilities.
France has already introduced legislation permitting approved operators to deploy counter-drone systems, while Germany is reviewing similar arrangements and Austria has announced plans to extend certain protective powers to infrastructure companies.
Poland has moved further by authorising designated security units to disable or destroy drones entering restricted areas around important energy installations.
The changes reflect concerns that national police and armed forces cannot provide permanent protection for every substation, power station, railway facility or pipeline against relatively inexpensive unmanned aircraft.
France establishes a new approach
In August 2026, the French parliament approved legislation allowing authorised operators of critical infrastructure and their contractors to detect, jam and intercept drones near designated facilities.
The legislation followed a series of reported drone incursions over sensitive locations, including military installations.
Under the French approach, operators of strategically important infrastructure may eventually use approved counter-drone systems without relying exclusively on the immediate intervention of military personnel.
Potential beneficiaries include electricity operators and organisations responsible for transport infrastructure.
French authorities are testing detection equipment, electronic countermeasures and interceptor drones at Brétigny-sur-Orge, south of Paris.
The programme examines systems capable of identifying approaching aircraft, determining whether they present a threat and initiating an appropriate response.
France intends to expand the protection of sites classified as strategically important, with further deployment planned during 2027.
The initiative would introduce responsibilities traditionally associated with military or police operations into the management of civilian infrastructure.
Germany and Austria reconsider existing restrictions
Germany is examining the legal conditions under which private companies and infrastructure operators could participate in active counter-drone operations.
At present, responsibility for neutralising threatening aircraft remains primarily with the competent public authorities.
The debate has intensified following security incidents involving unmanned aircraft, including the discovery of an explosives-laden drone near a Ukrainian cargo aircraft at Leipzig/Halle airport in August.
German authorities attributed the incident to Russia, an allegation Moscow denied.
The German government’s review concerns not only the equipment that companies may possess but also whether trained security personnel should be permitted to deploy countermeasures without waiting for a separate police authorisation.
Austria announced plans in September to extend comparable powers to selected critical infrastructure operators, including major energy companies.
The government has acknowledged the practical limitations of protecting a large number of widely dispersed installations using state security personnel alone.
Poland has already established restricted drone zones around sensitive energy facilities, with designated security units authorised to intercept aircraft entering those areas under applicable national rules.
Electricity networks face particular risks
Electricity infrastructure presents a difficult security problem because essential installations are distributed across extensive geographical areas.
Transmission operators manage thousands of kilometres of high-voltage lines, while substations, transformers and switching stations connect generation facilities to consumers.
A successful attack against critical equipment can produce consequences extending well beyond the immediate site.
Large power transformers are particularly difficult to replace. Manufacturing, transporting and installing specialised equipment can require lengthy preparation, making rapid recovery uncertain after serious damage.
European utilities have traditionally concentrated on physical security, maintenance and restoring services after technical failures or accidents.
The spread of drones creates additional demands for surveillance, early warning and the ability to respond before an attack reaches its target.
Russia’s repeated strikes against Ukraine’s electricity infrastructure have demonstrated the extensive disruption that attacks on power systems can cause.
European governments are now evaluating how comparable vulnerabilities could be exploited against their own networks.
Electronic jamming can interfere with communications and navigation systems beyond the targeted aircraft. A drone brought down over an industrial or residential area could injure members of the public or damage surrounding property.
Security personnel must also determine whether an unidentified drone is hostile, operating unlawfully or simply present because of an error by its operator.
A mistaken interception could expose infrastructure companies to compensation claims and other legal consequences.
European governments must therefore establish who can authorise an intervention, which countermeasures are permitted and how responsibility is allocated when damage occurs.
There is no uniform European approach.
Some operators support expanding their protective powers, while others argue that the use of force should remain the responsibility of the state.
Finland’s national electricity transmission operator, Fingrid, has expressed reservations about transferring such authority to energy companies.
The position reflects a wider concern that infrastructure operators should concentrate on maintaining essential services rather than assuming responsibilities for armed or coercive security operations.
A growing European security market
The regulatory debate is developing alongside a rapidly expanding market for counter-drone technology.
Manufacturers are offering equipment that integrates radar, optical sensors, electronic detection and software capable of classifying possible threats.
Interceptor drones and electronic countermeasures are increasingly being designed for use around civilian infrastructure rather than exclusively on military installations.
German defence company Rheinmetall has reported growing interest from private infrastructure operators in counter-drone protection.
However, the technology is advancing faster than the legal frameworks governing its use.
The immediate challenge for European governments is to establish protective arrangements that allow rapid intervention while preserving clear accountability.
A counter-drone system can identify an approaching aircraft within seconds. Determining who is authorised to stop it remains a matter for national law.
Turkey’s ruling AKP party is reportedly seeking a mandate from Parliament to deploy troops to Saudi Arabia to protect it from attacks by the Iran-backed Houthi insurgents of Yemen, thus fulfilling the mutual defense obligations of the treaty signed by Turkey, Saudi Arabia, and Pakistan in August.
Data centers are increasingly under attack in the Ukraine-Russia war, as well as Iran’s wanton drone and missile attacks on neighboring states like Bahrain and the United Arab Emirates (UAE), a study revealed this weekend.
On a Tuesday morning in February 2025, federal agents descended upon Ayala's Mini Market, a convenience store in Glendale, Arizona, that offered check cashing, money transfer, shipping, and cellphone repair services along with standard items such as groceries, snacks, sodas, and cigarettes. The agents, who worked for the Internal Revenue Service (IRS) and the Department of Homeland Security (DHS), seized three computers, five cellphones, and business records, plus about $460,000 in cash and checks. They did not say why.
Twenty months later, the store's owner, Mario Ayala, still has not received a definitive answer to that question. Nor has the government told him what it plans to do with his property or how he can try to get it back. That Kafkaesque situation is unconstitutional, Ayala's lawyers at the Institute for Justice argue in a motion and memorandum they filed on Tuesday in the U.S. District Court for the District of Arizona. The motion seeks the return of the property seized from Ayala's business, saying there is no legitimate reason for the government to keep it.
"The government can't take your stuff, disappear, and then never explain itself," says Institute for Justice attorney Betsy Sanz. "For over a year and a half, the government has been holding Mario's money and property. This prolonged seizure violates the Fourth Amendment and federal law. The government cannot hold onto your property indefinitely without explanation so it can eventually take it permanently using civil forfeiture."
The raid on Ayala's store happened while he was visiting his ailing father in Mexico, who died a couple of months later. After Ayala's wife and son called to tell him what had happened, he rushed back to Arizona, where he tried to figure out why his business had been targeted by the IRS and the DHS. That was harder than you might think.
Ayala "has heard nothing from the government since they raided his business and seized his property," Sanz and her colleagues note in their memorandum. When the agents left, they told Ayala's son that "the business would receive a letter within thirty days," the memorandum says, but "no letter came," and the government "has not told Mario why it took his property or why it refuses to return it."
The agents left a one-page inventory of the property they took, including the computers, cellphones (two of which belonged to Ayala's customers), documents, and currency, although it did not specify the amount of money. They also left the first page of a warrant signed by a federal magistrate judge, which contained no information about the crime they were investigating or the property they were authorized to seize. It referred to attachments that might have clarified those points, but the attachments were missing.
Ayala still has not seen those attachments. But on the same day the agents raided his store, they also searched 18 other businesses in the Phoenix area, all of which offered money services. Judging from the warrants served on three of those other businesses, which were signed by the same magistrate judge at the same time on the same day as the warrant for Ayala's Mini Market, the legal justification for the searches was suspected violations of 31 USC 5324, which makes it a felony to "structure" a financial transaction with the intent of "evading" federal reporting requirements.
The Bank Secrecy Act requires that financial institutions report cash transactions involving more than $10,000 to the Financial Crimes Enforcement Network (FinCEN). Although that mandate is aimed at money laundering, someone can be guilty of structuring even without evidence of any other crime if he deliberately tries to avoid triggering a FinCEN report by breaking up a transaction into amounts below the threshold. As far as Ayala can tell, the search of his store was based on nothing more than suspicion of structuring.
If so, Ayala's lawyers argue, the IRS agents who participated in the raid violated a 2019 federal law that bars the agency from seizing money when structuring is the only suspected crime. Congress passed that law in response to IRS forfeiture abuses highlighted by the Institute for Justice. "For the IRS to legally seize property based on a structuring offense, it must also have an added suspicion of some other criminal act," Sanz et al. note. "Yet the IRS seized Mario's property, apparently on the sole suspicion of a structuring violation."
That is not the only legal problem with the seizure. Assuming the government plans to seek forfeiture of Ayala's money based on an alleged connection to criminal activity, it missed a crucial deadline. The Civil Asset Forfeiture Reform Act (CAFRA) requires the federal government to notify property owners of attempted forfeitures within 60 days of the seizure. That deadline passed a year and a half ago, and Ayala still has received no such notice.
"This notice is crucial because it informs a property owner that the government intends to forfeit his property and triggers his ability to respond by filing a claim or administrative petition," Ayala's lawyers note. If the government fails to meet that requirement, CAFRA says, it "shall return the property."
The government can seek extensions of the CAFRA deadline "only if there is reason to believe that notice may have an adverse result," such as "endangering the life or physical safety of an individual," "flight from prosecution," "destruction of or tampering with evidence," "intimidation of potential witnesses," or "otherwise seriously jeopardizing an investigation or unduly delaying a trial." None of those conditions applies in this case, Sanz et al. say, and their client "is unaware of the government seeking any such extension here."
Another possible rationale for keeping Ayala's property is that the government needs it as evidence in a criminal investigation. But his lawyers argue that the seized items "have no independent evidentiary value."
The government "cannot claim that it is holding the cash as evidence of the suspected structuring offense, because the government—in the usual course—does not continue to hold the physical cash it seizes but rather promptly deposits it," the memorandum says. "To prove the suspected offense here, the government would present evidence documenting the amounts and frequency of transactions and evidence that the defendant intentionally evaded reporting requirements. No fact the government must prove to establish a structuring offense becomes more or less provable by the government's continued possession of Mario's money."
Although "the checks and business documents that the government seized from Mario may at first have had some evidentiary value," Sanz et al. say, it could have long since returned the originals and kept copies. As for the computers and cellphones, "the government has had ample time to extract and copy" any relevant information.
While the benefits of keeping Ayala's property seem highly dubious, the cost to him has been severe. The seizure of the checks and currency wreaked havoc with his business model, which relies on money received for transfers to cash checks, which in turn are scanned and used to pay the companies that handle the transfers.
"The search and seizure of Mario's property upended his business," the memorandum says. "He had to keep his business closed until March 1, 2025, to replace the seized computers and to figure out how they could keep the business open. He took $50,000 of his own money out of the bank so that he could keep cashing customers' checks. When that ran out, the business had to stop cashing checks for a long time, losing customers."
Ayala "also had to come up with $112,097.20 to pay the money transmitters to cover the balance that had accrued while he was away," his lawyers add. "Since all the cash and cashed-but-unscanned checks had been seized, Mario needed to pay this money to the transmitters on his own. Though he did ultimately pay back all the money transmitters over the following month, the consequences of the raid damaged Mario's business relationship with one of the money transmitters he had formerly worked with, InterMex. Today, the business can no longer offer InterMex as an option for money transfers."
Ayala's business "is now finally stable, but it is still not doing as well as it was before the raid," Sanz et al. say. "Mario has changed the way he runs his business because of the raid. He now scans every customer's cashed check to send it to the money transmitters as soon as it is cashed, rather than collecting [checks] and scanning them together as they previously did. He constantly worries that his business will be targeted again."
In the 20 months since the raid, the government has not filed a forfeiture action or even notified Ayala that it intends to do so. Nor has it filed any criminal charges related to the seizure, as far as Ayala knows. "The government has no lawful reason to retain
Mario's property," his lawyers say, "and this Court should exercise its equitable jurisdiction to order its return."
The motion relies on Federal Rule of Criminal Procedure 41(g), which says "a person aggrieved by an unlawful search and seizure of property or by the deprivation of property may move for the property's return." The U.S. Court of Appeals for the 9th Circuit, which includes Arizona, has adopted four criteria for granting such a motion: whether the government "displayed a callous disregard for the constitutional rights of the movant," whether "the movant has an individual interest in and need for the property he wants returned," whether "the movant would be irreparably injured by denying return of the property," and whether "the movant has an adequate remedy at law for the redress of his grievance."
All of those factors count in Ayala's favor, Sanz et al. argue. Ayala's interest in the property and the injury he is suffering are clear, as is the absence of any other remedy. As for the first criterion, "the government can neither forfeit Mario's property nor justify holding it as evidence, so its continued retention is unreasonable under the Fourth Amendment," the memorandum says. "And its nearly 20 months of silence, without any notice or any forum in which to contest the seizure, offends due process. At every turn, the government has 'callous[ly] disregarded' Mario's constitutional rights."
Ayala immigrated to the United States from Mexico in 1991 and struggled for years to make a go of his business, which was successful enough at the time of the raid that he planned to open a new location devoted to cellphone repair. That plan is now on hold because of the financial difficulties caused by the seizure.
"This business is my American Dream, and the government took years of my hard work without telling me what I did," Ayala says. "This raid hurt me and my family. I hope this lawsuit gets my money back and helps make sure this doesn't happen to anyone else."
A new migrant caravan of mostly Central American migrants left Mexico’s southern border with Guatemala on Tuesday. Many in the group, according to some reports, intend to posture near the U.S.-Mexico border in hopes that a Democratic win in the midterms might signal a return to a less secure border.
A senior Ukrainian diplomat joined a U.S.-hosted panel at the United Nations on Monday condemning human rights abuses by the communist government of Cuba, describing Cuban citizens as among the largest groups of foreign recruits aiding the Russian invasion of his country.
Alberta’s referendum to begin the process of seceding from Canada failed by a wide margin on Monday, keeping Canada’s oil wealth intact and delivering a major political win to Prime Minister Mark Carney.
One of the unfortunate quirks of the American system is that you can't lie to the government, but the government can lie to you. Samuel Tunick found himself on the receiving end of this setup last year at Atlanta International Airport. When agents from the Department of Homeland Security (DHS) asked for his phone password, he allegedly gave them a self-destruct code that wiped his data. Tunick now faces five years in prison for destroying evidence.
It turns out that the feds were lying to Tunick the entire time. A new court filing, first reported by 404 Media, shows that the DHS had sent out an order to seize Tunick's phone over his involvement in environmentalist protests in Atlanta. When he landed at the airport, however, agents told Tunick that they were looking for "kiddie porn" and he would be allowed to leave with his phone if he cooperated. They also repeatedly denied him access to his lawyer when he asked.
"There can be no real debate that if law enforcement had acted similarly elsewhere in Atlanta, their actions would be unconstitutional. But the government says it was entitled to act this way because Mr. Tunick was returning from an international vacation" in the Dominican Republic, his lawyers wrote in the filing, which includes internal DHS communications and excerpts from his interrogation video.
U.S. law recognizes a "border exception" to Fourth Amendment privacy rights, allowing federal agents to search incoming travelers for contraband. U.S. Customs and Border Protection (CBP) claims that this exemption also allows them to hold travelers for questioning and search their electronic data. Tunick's case reveals just how widely the agency stretches this loophole.
A few hours before Tunick landed, Homeland Security Investigations (HSI) agent Travis Mcghie emailed the CBP station in Atlanta with his photo and information, stating that he is under investigation for "suspected terrorist activities." (Tunick is involved in Save the Atlanta Forest, also known as Stop Cop City, a protest movement against a local police training center.) The email asked CBP to "conduct a 100% baggage exam, retain all electronics and collect passcodes," stating that the HSI will be at the airport to conduct an interrogation.
Pulled into the secondary screening room, Tunick "almost immediately" told CBP officers that "I don't really want to speak without a lawyer any more," according to the filing, which cites the interrogation tape. He would ask for a lawyer multiple times.
The agents asked Tunick if he had "kiddie porn" on his phone and stated that "because you're refusing to talk, we have the authority to go through your phone to see what we're looking for." One of them, Latoya Castro, told Tunick that "either you can give us your password so that we can go through it no problem, or you can refuse to do that, unfortunately, we will have to seize your phone."
Both of those statements were a lie, of course. The HSI's email had asked CBP to take Tunick's phone, whether or not he cooperated.
The lie about child porn may not only have been meant to intimidate Tunick. While there arecontradictory lower court rulings about the border search exemption, some courts have ruled that the CBP can only search electronics for "digital contraband," or files that are themselves illegal. A search for child sex abuse material would be on stronger legal ground than a search for mere evidence of other crimes.
Tunick was using GrapheneOS, a secure phone system that allows users to set both a real password and a "duress password" that wipes out all data when entered. The interrogation tape shows his phone appearing to reset after he gave the officers a passcode. HSI agent Nathan Burnham and FBI agent Andrea Coble then entered the room.
"You are not under arrest. Once these gentlemen are done with you, pursuant to your entry into the country, you're free to leave," Burnham said, referring to the CBP officers.
Tunick's lawyers argue that the judge should throw out the phone password Tunick provided and everything that resulted from entering it as an "involuntary" response made under "unlawful interrogation," because the CBP agents did not read Tunick his Fifth Amendment rights and ignored his multiple requests to consult with his lawyer before answering their questions.
The CBP claims that secondary screening at the border doesn't count as a criminal investigation, so detainees don't have the same rights as criminal suspects. "Since the international arrivals inspection is an administrative function, CBP policy and federal regs do not permit the presence of lawyers during secondary examinations," a spokesmantoldReason earlier this year.
But Tunick's lawyers insist that his experience was "far outside" a normal border crossing: He was accused of a serious crime to his face, faced an investigation for a different serious crime he didn't know about, and clearly could not leave the situation until he gave information to government agents.
"I hope people understand that the charges against me are meant to intimidate people against protecting their data and their privacy, and the government hopes to set a precedent that no one has the right to privacy," Tunick told 404 Media.
Defend the Atlanta Forest, the movement that Tunick is involved with, has been amajor nuisance for authorities in Georgia. Protesters attacked and burned construction equipment throughout 2022, and police shot a protester in 2023 under unclear circumstances, claiming that they were fired at during a raid.
The Trump administration has brought down the federal government against the movement. In June 2026, the Department of Justice broughtfederal charges against two alleged arsonists, citingNational Security Presidential Memo 7, which directs the feds to go after left-wing domestic terrorism.
But beyond the email line about "suspected terrorist activities," there is no indication of what specific crimes the feds suspected Tunick of, or why they suspected him. And the whole setup of the interrogation was designed to hide those answers. In fact, instead of charging Tunick under typical obstruction or evidence-destruction laws, federal prosecutors chose ararely-used statute that doesn't require them to disclose what the underlying investigation was about.
"Many times the government wants to highlight what it was trying to investigate because that ups the stakes on what the defendant was doing," former prosecutor Daniel RichmantoldThe New York Times. "This is a case where I think they're trying to avoid exactly that by focusing only on the destruction, and not what the investigation was about."
Government websites in Europe and elsewhere went offline on Wednesday after the disclosure of critical vulnerabilities in a widely used programming language sent website operators around the world scrambling to protect their systems.
Developers of the PHP programming language on Wednesday released urgent new fixes to vulnerabilities that had been lurking in their software for years until they were uncovered using AI, saying all users were “encouraged to update immediately.”
With tech firms warning that some hackers were already exploiting the flaws, government agencies across Europe were among those that took sites offline as a precaution.
Because a fix is now public and artificial intelligence tools are able to reverse engineer the bug with little effort, experts said they were bracing for a wave of intrusions as hackers jumped to get ahead of the updates.
AI was powering a “race to exploit,” said Costin Raiu, co-founder of cybersecurity research and incident response firm TLP:Black. He said the next step was the “mass compromise of every vulnerable web server on the internet.”
PHP — a language that dates back to the early 1990s and initially stood for “Personal Home Page” — underpins huge parts of the public-facing web and is baked into WordPress, Drupal, Joomla and Magento sites, meaning any critical vulnerability potentially has enormous knock-on consequences.
“All servers using any version of PHP released in the last 20 years will be vulnerable,” said Tiffany Farriss, the interim chief executive of the Drupal Association. “This issue impacts the majority of the internet.”
Cybersecurity agencies around the world have urged PHP users to update immediately or take websites offline until patches can be applied.
According to data from Censys, the internet intelligence firm, about 1.5 million out of 2.6 million hosts report running a version of PHP for which there is no fix.
The Dutch cybersecurity agency itself went offline, saying it had done so as a precaution because of the vulnerabilities. The operator of the online encyclopedia Wikipedia also said it had taken down an unspecified number of systems until they could be safely patched, while the Internet Archive, the sprawling online library, said it also briefly went offline to deal with the issue.
Even some world leaders weighed in. The Dutch prime minister said he was closely monitoring the situation. Japanese Prime Minister Sanae Takaichi in a post on X said website owners should “check whether your live site uses PHP and prepare to apply the new fix.”
BUG FOUND WITH AI
The flaw in PHP was discovered using artificial intelligence, two cybersecurity companies said in independent reports. Calif said in a blog post it found the flaws with the help of a large language model on August 1 and had been working on a fix ever since. Alphabet-owned GOOGL.O cybersecurity company Wiz said in a blog post that it too had discovered it with the help of Wiz Atlas, its autonomous AI vulnerability research tool, as well as Google’s Gemini 4 Argon and OpenAI’s GPT-5.6 Sol.
The vulnerabilities remained hidden in the PHP codebase for more than a decade and would have been extraordinarily complicated for a human hacker to take advantage of, Wiz’s post said.
“Pre-AI, this manual work would be difficult to implement and even harder to scale,” it said. “With AI, this is no longer a barrier.” Calif and Wiz said they coordinated with one another and the PHP team and OpenAI on the discovery.
In a statement, the White House said it was made aware of the flaw on Friday.
In a blog post late on Wednesday, Amazon AMZN.O security chief CJ Moses said the tech giant’s security team detected an attempt to exploit the vulnerabilities against one of its decoy “honeypot” systems on October 17, four days before public disclosure.
The attempt on the system came from an anonymous internet address, suggesting the activity was conducted by a threat actor, Moses said, adding it was unclear how the actor learned of the flaws while they were under embargo.
More attempts followed on Wednesday by multiple actors before the embargo lifted. Amazon said it was still unclear whether any of the attempts would have worked against real websites, adding the flaws were “now being broadly exploited in the wild.”
CRITICAL SOFTWARE
PHP is a programming language used to run websites. When a visitor loads a page, a server running PHP assembles the content and sends it to the browser. It is free, open-source software maintained by volunteers.
Its ubiquity — PHP runs roughly 75% of websites whose programming language can be identified, according to web technology tracker W3Techs — has made experts anxious. AI-assisted hacking campaigns, which have proliferated in recent weeks, could wreak havoc on unpatched servers, said Lukasz Olejnik, a visiting senior research fellow at King’s College London.
“The scale is huge, and with AI, exploitation may happen instantly,” Olejnik said.
WordPress.com operator Automattic said users of its hosted solutions and Tumblr were safe from the bug. Risks were higher for small PHP-powered websites run by individuals or organizations with limited technical resources, often on shared hosting services where customers do not directly manage the underlying servers.
MASS OUTAGES
In the Netherlands, several organizations followed the example of the National Cyber Security Centre and took public-facing websites offline, including the Port of Rotterdam, government portal Overheid.nl, the national soccer association KNVB, the websites for the country’s five largest political parties and several hospital websites.
Danish municipal IT company Kombit said it had shut down several services, including the national school communication platform.
Disruption was even more widespread in Finland, where state IT services provider Valtori said government public network services had been taken offline “as a precautionary measure.”
France’s Interior Ministry said it had placed all of its websites into preventive maintenance.
Your phone buzzes. Another political text. This time, it's an urgent fundraising appeal claiming a campaign desperately needs your help before midnight. You delete it, block the number and get on with your day. Then tomorrow, another one arrives from a completely different number. Sound familiar? I've been there, and frankly, I'm fed up with it.
On The CyberGuy Report podcast, I sat down with George Weiner, founder of PACspam.org and head of the digital agency Whole Whale. George got so frustrated with the relentless political texts that he created a free tool to help people figure out who's sending them. Our conversation revealed why blocking numbers often gets you nowhere, how political fundraising has become a lucrative business and what you can do to fight back.
Join our upcoming CyberGuy LIVE class: 5 Ways to Travel Smarter and Save Money
In this free live online class, Kurt "CyberGuy" Knutsson will share five practical ways to protect your trip and your wallet this holiday travel season. You’ll learn how to secure your phone and personal information, find better travel deals, avoid common scams, save money on bookings and use technology to make your travels easier and less stressful. No technical experience is needed.
Join us Saturday, October 31, at 11 AM ET / 8 AM PT. Register free now at CyberGuyLive.com.
Why blocking political text messages doesn't work
You would think blocking a phone number would send a pretty clear message. Apparently, political texting operations don't always take the hint. I asked George why texts from the same political groups kept showing up after I blocked their numbers. "Well, you block one number and you've only blocked one number," Weiner explained.
He introduced me to a technique called snowshoeing, which allows an organization to spread its messages across multiple phone numbers. A single campaign or political action committee (PAC) may use many different numbers to reach the same people. So, even after you block one sender, another number can deliver the next fundraising appeal.
For George, this frustration became personal. As a father of three, he worries about missing an important call from his children's school. "That could be the school, right? That could be an emergency," he explained. Instead, his phone often interrupts him with another fundraising appeal. He tried replying STOP, reporting messages and registering for the National Do Not Call Registry. Yet the interruptions continued. "I have done it all and I still get these messages," Weiner said. That raises a question I've been asking for years. How did these organizations get our phone numbers in the first place?
How political campaigns get your phone number
You might assume a campaign needs your permission before adding your number to its texting list. Unfortunately, political outreach operates under rules that leave plenty of room for unsolicited messages. Weiner explained how phone numbers can circulate through political donor and voter databases. Campaigns may also combine registration information with commercially available data to identify potential supporters. Furthermore, organizations can purchase or exchange contact lists, allowing your information to reach groups you've never heard of.
Voter registration records vary by state, and phone numbers aren't necessarily public in those records. However, organizations can match voter information with other databases to build detailed contact profiles. Political donations can create additional exposure. As we've previously reported, federal political contribution records can reveal personal information, including your name and address when disclosure requirements apply. Once your number enters this fundraising network, tracking every organization that holds it becomes extremely difficult.
The money behind nonstop political fundraising texts
Here's something from my conversation with George that really caught my attention. There's a substantial amount of money flowing through the political texting business, and the people sending these messages have financial reasons to keep doing it. Weiner pointed to approximately $65 million spent on political texting services during the 2024 election cycle, based on his analysis of Federal Election Commission records. He also believes 2026 spending could exceed that amount, although a final election-cycle total isn't yet available.
George also highlighted how much money individual political messaging vendors receive. According to PACspam's analysis of FEC records covering December 2008 through May 2026, reported payments totaled $17 million for Switchboard, $14.4 million for Mothership Strategies and $10.6 million for Message Digital. These figures span multiple election cycles and reflect reported payments to political messaging vendors, which may include services beyond texting.
Why political fundraising texts keep coming
"There is money to be made," Weiner told me. He explained that fundraising operations can keep paying to send messages as long as the donations they generate justify the expense. Even a small percentage of people responding with money can make another round of texts financially worthwhile. Some appeals claim a donation deadline is approaching or suggest a candidate faces an immediate financial emergency. Others use provocative headlines designed to make you react before thinking.
Weiner also raised concerns about how much money some PACs actually direct toward candidates. He pointed to investigations suggesting that certain organizations spend heavily on fundraising while relatively little reaches the candidate being promoted. PACs operate under different rules, however, and not all are established to make direct candidate contributions. That's why it's important to investigate where your donation will go. And this problem crosses political lines. Weiner stressed that organizations associated with different political parties use these tactics. The repeated pleas for money, he believes, can end up alienating the very voters campaigns want to reach. That brings us to an interesting way to investigate who's behind the messages.
How PACspam helps identify who's sending political texts
George created PACspam.org to give people more information about the organizations filling their phones with unsolicited political messages. "Our phones don't have to live like this," Weiner said while explaining why he built the tool. The free service analyzes political fundraising texts and attempts to identify the committee behind them. It can examine fundraising links and use public campaign finance information to help trace the organization responsible. PACspam also helps document complaints and tracks repeat offenders using information connected to FEC-registered committees. Its public leaderboard focuses on texting behavior rather than political affiliation. Meanwhile, its FEC Texting-Spend Explorer lets visitors investigate campaign spending on texting services. In some cases, PACspam can also help identify the texting technology provider that delivered the message. That last part is particularly interesting because those technology companies may serve multiple political organizations.
Rather than contacting only the committee asking for money, Weiner suggests contacting the texting platform when it can be identified. "They do answer," Weiner told me when I asked whether these companies respond to complaints. He described receiving a response from the legal department of a texting provider. That company explained how he could request placement on its own do-not-contact list. The approach could be more useful than blocking one phone number because it targets a provider that may handle messages for multiple political organizations. Still, one company's removal list won't necessarily apply to competing platforms. Of course, results can vary. An organization may use another platform, and some messages don't contain enough information to identify the sender. Still, contacting a texting provider offers another avenue to pursue.
Getting started requires only a political text you've received. Here's what to do.
Visit PACspam.org.
Copy the unwanted political message from your phone. You can also upload a screenshot if you prefer.
Review the message or screenshot for personal details you don't want to share.
Paste the message into the site's lookup tool, or upload your screenshot.
Select Look up sender to analyze the message.
Review any identified committee, fundraising link or texting provider.
Use the generated complaint information to contact the relevant organization through available official channels. You can also review the site's reporting options.
PACspam can prepare complaint information and help document unwanted political messages, but it doesn't automatically send those complaints on your behalf. It also cannot guarantee that your number will disappear from political texting lists. I also asked George an important privacy question. What happens to the information people submit? "We're not collecting your number. I just want that message," he said. According to Weiner, you don't need an account to use PACspam. Whole Whale also says uploaded screenshots are processed and discarded, while personal messages aren't displayed publicly. Those are the service's stated privacy practices, so I still recommend removing identifying details before submitting anything.
Are unsolicited political text messages legal?
Here's where things get frustrating. The Federal Communications Commission treats political texts differently depending on how they're sent. Political messages sent through an automatic telephone dialing system generally require prior express consent before reaching your cellphone. However, messages sent manually through peer-to-peer texting systems can fall outside those restrictions. That helps explain why so many campaign texts can reach people who never specifically requested them.
The National Do Not Call Registry generally doesn't cover political outreach either. So, registering your number may reduce some telemarketing calls without stopping political fundraising appeals. The FCC also says political campaigns should honor opt-out requests when recipients reply STOP. For robotexts covered by federal consent rules, revocation requests must generally be honored within 10 business days. However, an opt-out from one sender won't necessarily remove your number from other political organizations' databases.
5 ways to block political text messages and protect yourself
You may not be able to eliminate every political text, but several steps can reduce the interruptions and help protect your information.
1. Reply STOP when you recognize the sender
If you receive a message from a legitimate political campaign or organization, replying STOP can unsubscribe you from that sender's messages. However, be selective. If the text looks suspicious or contains an unfamiliar fundraising link, avoid responding. Scammers sometimes impersonate political organizations, and engaging with suspicious messages may confirm that your number is active.
2. Turn on spam filtering on your phone
Your smartphone already has tools that can help move unwanted messages out of your main inbox. Here's where to find them.
On iPhone running iOS 27:
Open the Messages app.
Tap the Filters button.
Select Manage Filtering.
Turn on Screen Unknown Senders.
Make sure Filter Spam is enabled.
Unknown senders can move into a separate folder, reducing interruptions. If needed, tap Allow Notifications to choose which categories of unknown messages can still alert you. Availability varies by region.
On Google Pixel or Samsung Galaxy using Google Messages:
Open Google Messages.
Tap your profile picture or icon.
Select Messages settings.
Tap Protection & safety.
Select Spam protection.
Turn on Enable spam protection, if available.
Google Messages can flag suspicious texts and move some of them into the Spam & blocked folder. Menu options may vary by device and app version. Remember to review your filtered messages occasionally so important texts don't get overlooked.
Blocking individual numbers can reduce messages from persistent senders, even though other numbers may still get through.
On an iPhone, open the unwanted conversation, tap the sender's icon, select Info and choose Block Contact. On an iPhone, reporting a message as spam doesn't automatically block the sender. You need to block the contact separately if you want messages from that number stopped.
On Google Messages, touch and hold the unwanted conversation, then tap Block. You can also select Report spam before confirming.
4. Report unwanted texts to your carrier and the FCC
You can forward unwanted political texts to 7726, which spells SPAM on a telephone keypad. This alerts your wireless carrier and can help its spam detection efforts. For suspected violations of federal calling or texting rules, you can also submit a complaint through the FCC Consumer Complaint Center. If the text appears to be a scam, report it to the Federal Trade Commission at reportfraud.ftc.gov/. Keep a screenshot of the suspicious message if you may need it for your report.
5. Donate directly and limit your personal data exposure
One of George's strongest recommendations involves political donations. If you want to support a candidate, find that candidate's official website yourself rather than following a link in an unsolicited text. During our interview, George warned that donating through unfamiliar political fundraising texts can encourage additional solicitations. He described how a successful donation might lead organizations to think, "we got one, let's send twice as many messages." His recommendation was straightforward: Give through the candidate's official website instead of an unsolicited fundraising link. That helps you verify who is receiving your money. However, even donating directly can lead to additional campaign messages, so review the site's privacy disclosures and contact preferences.
Additionally, consider limiting how widely your phone number appears online. Data brokers can collect and resell personal information, and removing your details from covered sites may reduce future exposure. Check out my top picks for data removal services and get a free scan to find out if your personal information is already out on the web by visiting CyberGuy.com.
Keep in mind that commercial data removal services cannot erase legally required public campaign finance records. They also can't guarantee removal from every political organization's contact database.
Kurt's key takeaways
What struck me most about my conversation with George is how much money is being made from messages that so many of us desperately want to stop. We block numbers and ask to be removed, yet the texts keep coming. And the organizations making money from this system have little incentive to change it. I appreciate that George decided to do something about it. His PACspam tool offers a way to investigate who's behind these messages and push back through official complaint channels. I'd love to see political organizations become more accountable for how they use our personal information. After all, supporting a candidate shouldn't mean giving every fundraising operation unlimited access to your phone. Want to hear exactly how George is fighting back? Listen to my full interview with George Weiner on The CyberGuy Report podcast. We dig deeper into the political texting business, the companies behind it and what you can do when blocking numbers fails. And if you're ready to reduce even more unwanted messages, head to CyberGuyLive.com for my free Sick of Spam? class replay. You'll get practical advice for reducing robocalls, unwanted texts and junk email, along with a free spam-stopping checklist.
Should political campaigns have to get your permission before sending fundraising texts, and should the companies profiting from those messages face consequences when you repeatedly ask them to stop? Let us know by writing to us at CyberGuy.com.
Sign up for my FREE CyberGuy Newsletter
Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox.
For simple, real-world ways to spot scams early and stay protected, visit CyberGuy.com –trusted by millions who watch CyberGuy on TV daily.
Plus, you'll get instant access to my Ultimate Scam Survival Guide free when you join.
The PHP Foundation has revealed two serious vulnerabilities that could impact millions of websites. Security experts warn that failure to quickly patch the flaws could have dire consequences.
Move follows request from Israeli authorities, in wake of last month’s flydubai attack; direct flights on Israel-Morocco route only resumed in August after nearly 3 years
Hackers around the world are all-in on using agentic AI to wage attacks—and manipulating tools like Anthropic’s Claude to help them carry out their crimes.
Developers of the PHP programming language said they had identified two critical vulnerabilities, and urged users to update their sites as soon as a fix was released.
Developers of the PHP programming language said they had identified two critical vulnerabilities, and urged users to update their sites as soon as a fix was released.
Login
