A critical security flaw in the programming language underpinning much of the web has prompted a global rush to patch vulnerable systems.

© Vincent West/Reuters

An uncanny strength of the second Trump administration has been its ability to be involved in so many scandals that no single one seems to become a dominant story.

Take the most recent allegations about Alina Habba, Trump's former personal defense attorney, who recently landed a plush gig working for Julio Herrera Velutini, a Venezuelan banker. Habba will get $50 million over five years to do unspecified work for a company that barely exists, according to The New York Times, while Herrera got a presidential pardon for a 2025 campaign finance charge.

That's just a typical day for the current White House, where the mingling of personal and public business has become routine. Some days, the story is President Donald Trump trying to help himself to taxpayer funds by suing the government he runs, or shipping billions of taxpayer dollars to a foreign mining company partially owned by his sons. Other times, it is Trump selling political influence in the form of digital coins, or his appointees getting caught in naked pay-to-play schemes. If you have a hard time keeping track of it all, I get it. The corruption is so deep and wide that focusing on any singular item becomes difficult.

But that constellation of corruption might finally be breaking through to voters ahead of next month's midterm elections.

A recent Fox News poll found that "government corruption" was the top issue for voters, ranking ahead of inflation and gas prices. Conservative commentators are taking notice.

"What they're saying is, 'Look, we're tired of you getting rich and us getting poor,'" former White House Chief of Staff Mick Mulvaney said this week.

Tim Carney, senior columnist at the conservative Washington Examiner, also tabs the corruption issue—along with other "avoidable mistakes" such as the Iran War and tariffs—as one of the major reasons why Democrats are likely to win the midterms:

Trump and his family have enriched themselves in this second term in ways more similar to third-world regimes or Cook County than to any previous administration. He and his family operate a financial company that has received heavy investments from Qatar's government. He's sold access to himself by selling otherwise worthless cryptocurrency. The IRS he controls settled a lawsuit with him, promising to pay him $1.8 billion (this settlement was voided by a judge).

Trump is not directly on the ballot next month, of course. And most voters might not be able to tell you the details of any single Trump scandal in detail. Even so, this may turn out to be the defining narrative of the second Trump administration, and there seems to be a growing consensus that Republicans have allowed (if not aided and abetted) his corrupt behavior, so it's time to give Democrats a shot at reining it in.

The Trump corruption issue is like the Biden cognitive decline issue in one key sense: Everyone around the president or even supporting him professionally from afar should be asked about it, and their lies/claims of ignorance should be hung around their necks like dumbbells.

— Matt Welch (@MattWelch) October 20, 2026

Vice President J.D. Vance told journalist Mark Halperin this week that he's "never seen any evidence that anybody's selling access to the president." When Halperin pushed back, Vance doubled down: "What I would say is I don't think there's evidence that the Trump family has become enriched by politics," the vice president said.

So either Vance isn't paying attention, or he's deliberately misleading. "Credit to Vance, it's as good an argument as is available to him," writes Daniel Foster at National Review. "The bad news is it's still not very good."

---

The internet nearly crashed on Wednesday as digital security and website administrators scrambled to patch two vulnerabilities in the PHP programming language that serves as the basis for many websites.

"Since its development in the 1990s, PHP has evolved into an essential scripting language for web development and is used across vast swaths of the internet in websites and software," explains Wired. "Everything from publishing systems like WordPress and Drupal to e-commerce platforms like Adobe's Magento are built on PHP."

Amid fears that hackers and AI agents could exploit the security weakness, many websites were taken offline. The National Security Agency and its counterparts in the United Kingdom and the European Union sounded the alarm. Even the prime minister of Japan, Sanae Takaichi, was telling website administrators to take the issue seriously.

The potential hacking abilities of advanced AI agents make these sorts of security risks more serious. In this case, however, the problem was also identified with the help of AI.

"Ryan Austin, a researcher at Calif, uncovered the flaws with help from GPT-5.6 Sol, one of OpenAI's most advanced models, during an audit of PHP's source code in August," The Wall Street Journal reports. Another security researcher had flagged the issue years ago, but it had never been fixed because it was considered "considered too difficult to exploit" by human hackers.

This is the future of humanity's digital landscape. "Given the severity of these flaws and PHP's widespread use, we consider this one of the most impactful security issues in recent memory," OpenAI said in a statement on Wednesday. "It highlights how AI can uncover security flaws with internet-scale impact, but the same capabilities can also help attackers rapidly develop offensive tools and exploits."

(A shoutout to Reason's web development team for keeping us up and running, today and every day.)

---

"Fanciful fiction." Media outlets also continue to face decidedly nondigital threats over articles and polls that make the president unhappy.

The White House threatened Politico on Wednesday with unspecified "consequences" for publishing "fanciful fiction" in a series of articles earlier this month about White House Chief of Staff Susie Wiles. If the articles are not retracted, it would trigger "an immediate review of Politico's relationship with the White House, and, of course, consideration of all other appropriate and available legal remedies," wrote White House counsel William O. Scharf in a letter to the media outlet's publisher.

Meanwhile, FCC Chairman Brendan Carr issued vague threats to broadcasters who cover what Carr called "Fake Polls" intended to "alter the normal patterns of voter turnout and enthusiasm."

These sorts of threats are an affront to the First Amendment, of course. But they are downstream of a more significant issue: the very existence of the FCC.

It's a problem, obviously, that the FCC is run by an authoritarian jackass. But the bigger problem is that the agency contains so many tempting tools for an authoritarian jackass to wield. https://t.co/Q4IJXntkOy

— Jesse Walker (@notjessewalker) October 21, 2026

---

QUICK HITS

• A judge in New Mexico ordered social media giant Meta (which owns Facebook and Instagram, among other things) to pay $25 billion for misleading users about data privacy. Last month, a jury found that Meta had violated the state's consumer protection laws 43 million times.
• Officials are trying to pin the blame on Elon Musk for a Starlink slowdown that limited the effectiveness of Ukrainian missile defenses. Musk says the decision was made by the U.S. military and Trump.
• Peter Thiel joins the majority of Americans in thinking that Trump's Iran War was a mistake. Even so, the U.S. and Israel are reportedly planning another round of attacks after the election.
• The environmental studies for California's high-speed rail line include such absurdities as counting bumblebees "one by one" and considering the train's "acoustic impacts on waterfowl and shorebirds." That's how to spend 16 years and $15 billion building nearly nothing.
• Obvious metaphor alert!

A group dispatched by Hegseth's team in February attempted to move the historic globe, said to be used by Eisenhower during World War II.

They lifted it from its home in an Army office in the Pentagon … and dropped it. pic.twitter.com/vTjWdYXn0k

— Dan Lamothe (@DanLamothe) October 22, 2026

The post The Swamp King appeared first on Reason Magazine.

Governments and businesses around the world scrambled to prevent hackers from exploiting a vulnerability in PHP, a popular programming language.

© Geert Vanden Wijngaert/Associated Press

The disclosure heightened concerns about A.I.’s potential to upend cybersecurity unless shortcomings are addressed.

© Annegret Hilse/Reuters

O aviso surge numa altura em que está em curso uma auditoria interna, entre outras avaliações, à contratação de empresas e gestão de bens apreendidos pela instituição, durante o mandato de Luís Neves.

© RODRIGO ANTUNES/LUSA

French Finance Minister Roland Lescure told Parliament on Tuesday that about 700 of the country's 10,000 supermarkets were affected.

Luís Rosa e Paulo Saragoça da Matta explicam, em mais um “Duelo”, como funciona a lei de proteção de testemunhas e a suspensão (e posterior recuo) da proteção especial concedida ao ex-hacker Rui Pinto

Lúcio Correia, professor de Direito de Desporto, critica a Federação Portuguesa de Futebol por ‘fato à medida’ disciplinar para Cristiano Ronaldo e diz que o atleta está a ser beneficiado.

Ataque sem precedentes afetou pelo menos 150 lojas Intermarché e 80 do Carrefour. Agência francesa de Cibersegurança investiga por ordem do primeiro-ministro.

© AFP via Getty Images

Only the US and Israel were hit by more cyberattacks than Ukraine this year. Ukraine ranked third in the world and first in Europe among the countries whose organizations and users were most often targeted by cyberattacks in the first half of 2026, accounting for 4.8% of all victims worldwide, up from fifth in the world and third in Europe a year earlier, Microsoft said in its Digital Defense Report 2026.

Microsoft processes more than 165 trillion security signals a day, which lets it show how often attackers go after customers in each country. Russian state hackers aimed 14% of their recorded activity at Ukraine, more than at any country except the US.

The era of machine-speed cyberattacks is here

Government agencies and services were the most targeted sector worldwide at 27%, up from 17% in 2025. Phishing drove 23% of intrusions Microsoft investigated, up from 7% a year earlier, and the median time from finding a vulnerability to weaponizing it has fallen well below 24 hours.

The use of artificial intelligence is pushing cyberspace into an era of “machine-speed” attacks that operate continuously and without fatigue, according to Dev.

“Many AI agents act on behalf of users and with their access rights, so a compromised agent combines user-level access with machine-scale actions,” Natalia Burlakova, Security Sales and Engineering Lead at Microsoft, says.

Deception beats code in attacks on Ukraine

Ukraine's own agency data show a similar pattern. Malware accounted for 33% of cyber incidents in the first half of 2026, and social engineering 31%, the State Service of Special Communications and Information Protection reported on 30 September. System infections made up 15%, and system compromises 4.5%.

Attackers rely less on technical complexity than on trust, according to the report by Ukraine's computer emergency response team, CERT-UA. Hacker groups create fake pages that mimic CERT-UA, Ukraine's Parliament's document management system, and the Brave1 defense technology platform.

Microsoft urges five government steps

Microsoft asks governments to prepare for faster-moving threats by assigning roles and coordinating agencies in advance of a crisis, and to treat AI security as part of national resilience. It also asks them to plan for incidents that spread, noting that 52.2% of intrusions involving valid accounts led to additional credential theft.

FBI and US Coast Guard investigators have found evidence that hackers accessed the propulsion system of an oil supertanker as it was approaching the Texas coast this summer, according to US officials familiar with the matter, an extraordinary breach that highlights the growing physical risks from cyberattacks.