OpenAI-assisted research uncovers critical PHP security flaws affecting millions of websites

Sources · 13 sources

1. DI

   Digit@digitindiaPost on X · 5d ago

   Critical PHP security flaws have triggered warnings from CERT-In, the FBI, Google & OpenAI.🚨 The vulnerabilities could let remote attackers execute code on affected systems.⚠️ Here's what governments and tech companies said:👇 - https://t.co/St5d1sv272 #PHP #Google #OpenAI

   Open source
2. *B

   *Walter Bloomberg@DeItaonePost on X · 5d ago

   OPENAI: DUE TO SEVERITY OF THESE FLAWS & PHP’S WIDESPREAD USE, WE CONSIDER THIS BUG TO BE ONE OF THE MOST IMPACTFUL VULNERABILITIES IN RECENT MEMORY

   Open source
3. LD

   Lark Davis@LarkDavisPost on X · 4d ago

   Government websites across Europe and beyond went dark on Wednesday because of critical bugs. PHP’s developers rushed out urgent fixes for flaws that had been hiding in the code for years until AI dug them up, and told everyone to update right away. The panic was real. I can picture developers racing to patch like it’s a Hyrox event, sprinting from one server to the next. But there’s a silver lining. AI found these bugs, which means the bad actors don’t automatically have the upper hand. The white hats got there first, and they won this round.

   Open source
4. CB

   Coin Bureau@coinbureauPost on X · 5d ago

   🚨ALARMING: Up to 70% of the world's websites could be at RISK after AI researchers uncovered PHP2Shell, a CRITICAL security flaw in PHP, per WSJ. The vulnerability could allow hackers to hijack unpatched servers, steal sensitive information and launch attacks against website visitors. PHP is widely used by WordPress, government portals and e-commerce websites. Two reported vulnerabilities carry a SEVERE 9.2/10 rating and could allow attackers to remotely execute malicious code without authentication. The latest developments: 🇫🇮 FINLAND: Shuts down state internet services over the security flaws. 🇳🇱 NETHERLANDS: National cybersecurity agency takes its website offline. 🇫🇷 FRANCE: Temporarily shuts down prefecture websites pending security fixes. CLOUDFLARE ($NET): Reports early attacks and says protective changes are LIVE. Emergency patches were released a DAY EARLY after vulnerability details leaked. EU cybersecurity officials are urging IMMEDIATE patching and advising operators to take vulnerable sites offline if fixes cannot be applied. The biggest concern is that AI could accelerate the development of exploits, potentially allowing hackers to weaponize the vulnerabilities before millions of websites can be secured.

   Open source
5. TE

   TechmemeArticle · 5d ago

   The PHP Foundation details how it found and fixed the two flaws, and says it had to release patches a day early after the two CVE IDs began circulating online (The PHP Foundation) The PHP Foundation : The PHP Foundation details how it found and fixed the two flaws, and says it had to release patches a day early after the two CVE IDs began circulating online — Earlier today, the PHP project released PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. These releases fix two critical vulnerabilities that …

   Open source
6. TE

   Techmeme@TechmemePost on X · 5d ago

   The PHP Foundation says its RCE patches are limited to PHP 8.2 and newer, leaving legacy deployments dependent on third-party vendors (Wired) (Visit Techmeme dot com for the link and full context!)

   Open source
7. MT

   MTS@MTSlivePost on X · 14h ago

   Weekly Situation Recap 10/19-10/25 Black October Though real-world impacts have lagged behind, AI has been cyber-capable for quite some time now. Anthropic finished training Claude Mythos Preview in February. It was substantially better than previous models at cyber tasks, so instead of releasing it right away, Anthropic and industry partners secretly launched Project Glasswing to find and fix vulnerabilities in open-source software so they couldn’t be exploited. Anthropic announced Mythos and Glasswing in April, but didn’t release a Mythos-class model to the public until Fable in June, when they had built strong enough safeguards to block the model from doing cyber tasks. Other labs soon caught up. In May, OpenAI launched Daybreak, their own version of Project Glasswing, and in July, they caught up to the cyber frontier with GPT-5.6 Sol. Chinese labs kept pace a few months behind, with https://t.co/90zyG2rPa4’s GLM-5.2 in June, then Moonshot AI’s Kimi K3 in July, and finally https://t.co/90zyG2rPa4’s GLM-5.3 in August, which was about as cyber-capable as early Mythos. Yet despite the Cyber ECI climbing steadily month after month, and despite warnings from cyber experts growing louder and louder, there was no increase whatsoever in cyberattacks on American citizens between June and September. Then, all of a sudden, the last week saw a flood of disclosed vulnerabilities in various important pieces of software. A quick timeline: Monday: A Chinese hacker used just $5k of tokens to break into over 100 websites, including ones owned by major companies like Deere, SharkNinja, and Cummins, using the penetration-testing agent harness Cairn. Anthropic announces OSS Scanner, a free service scanning open-source code repositories for vulnerabilities. Tuesday: Vals AI finds that the open-weight DeepSeek-V4.1-Flash-1017 (released on October 17), beats the cyber-enabled version of GPT-6 Sol (released less than a month earlier, on September 22), on their offensive cybersecurity evaluation. Fortinet, a major cybersecurity company, announces that they will release a set of security updates across their products to help defend against agentic cyberattacks. Wednesday: Two critical vulnerabilities in PHP, a scripting language powering the majority of sites on the Internet, are patched with the help of OpenAI’s Patch the Planet program. The NSA urges all organizations using PHP to update immediately, or take their systems offline until the vulnerability can be mitigated. GitLab, a software development platform with over 50 million users, releases a critical patch to fix a vulnerability that allowed for remote code execution. Node.js releases a critical patch for their own remote code execution bug. Railway, a platform for deploying software in the cloud, discloses a major breach where attackers were able to access ~100k customer environment variables, and urges users to rotate their API keys. LiteLLM, an LLM gateway, discloses their own breach. Jason D. Clinton, Deputy Chief Information Security Officer of Anthropic, says “things are going to get a lot worse before they get better.” Thursday: Axios reports on banks seeing a major increase in unauthorized agent activity in user accounts, though most of this is users’ personal agents acting on their behalf. Abliteration¹, a startup that sells access to open-weight models with cyber guardrails removed, releases abliterated-model-large-flash, an abliterated version of DeepSeek-V4.1-Flash-1017. Quest Diagnostics, a healthcare company serving tens of millions of Americans, announces it was breached and sensitive patient information was stolen. Sam Altman says “I no longer think we’re going to be able to just patch all the bugs. We’ll have to use the same AI technology to build a new kind of defense shield.” Matthew Prince, CEO of internet infrastructure company Cloudflare, says he is aware of “a bunch of additional severe vulnerabilities that are present in other pieces of critical software” and says “I think we’re going to have a couple years where every single week it’s going to feel like the sky is falling.” Moonshot AI releases Kimi K3.1 Pro, which outperforms all publicly available models on cyber tasks, even despite Moonshot saying it will not push the absolute cyber frontier. X users take to calling the recent slate of cyber incidents “Black October.” Friday: OpenAI reveals that the vulnerability in Node.js came from Brotli, a compression library used in a lot of software, including the JavaScript runtime environment Bun (now owned by Anthropic and a critical part of Claude Code). Saturday: GMO Internet Group, Japan’s largest internet infrastructure company, experiences a major cyberattack where some users’ financial accounts were drained. They call for help from the government, and CEO Masatoshi Kumagai says that “the Internet itself is on the verge of collapse.” So, will there be major disruptions to the Internet or real life? Something like the French supermarket hacks from last week that shut down refrigeration systems and forced hundreds of markets to throw out food, but at a much larger scale? It’s not clear. On the one hand, the trend lines are clear. AI is getting increasingly powerful and its capabilities are getting increasingly diffuse, and attack surfaces are just so vast. Defenders have to patch all the vulnerabilities, while attackers only have to exploit one of them. “Security by obscurity” is now completely inadequate, as agent swarms can scan for vulnerabilities more tirelessly than any human. On the other hand, most of the cyber incidents reported (so far) are disclosures of vulnerabilities that have already been patched. Markets don’t seem to be reacting much. SPY fell 0.95% over the past week. CIBR, the First Trust NASDAQ Cybersecurity ETF, rose 5.91%. VIX, a measure of volatility, rose 5.82%, a negligible spike compared to major world events from the last few years like COVID, Trump’s Liberation Day tariffs, or the Iran War. And defenders are much better-resourced than attackers. So maybe agentic botnets will overwhelm the cyber infrastructure that we take for granted, forcing much of the internet offline as defenders scramble to take them down, and impacting people’s lives like COVID. Or maybe society’s ability to respond will be strong enough to address these problems before they manifest fully, and it’ll be another Y2K. In either case, you can make yourself a more difficult target. Turn on automatic updates for your phone, computer, browser, and apps. Don’t click on suspicious links or emails. Never reuse passwords, and store them securely in a password manager like 1Password. Use two-factor authentication with your accounts, and use an authenticator app like Duo Mobile rather than your phone number. Add a port-out pin with your mobile carrier so they won’t transfer your phone number to an attacker’s SIM card. Set up a family safe word or phrase to avoid voice scams over the phone, and turn off voice authentication at your bank or mobile carrier. If you really want to be secure, use a Yubikey, a physical hardware authentication device, instead of a password. One worrying sign for the future: If this is how AI makes impacts in the real world — first by silently climbing benchmarks while the real world stays exactly the same, then by crossing some critical threshold that causes real-world impacts to go vertical — it really doesn’t bode well for society’s ability to respond to much larger future problems like biorisk, unemployment, or loss of control. More Situations Moonshot AI releases Kimi K3.1 Pro, which matches Claude Opus 5.5 and GPT-6 Astra on a number of benchmarks. Arena finds that it outperforms all non-OpenAI/Anthropic models (except Gemini 4 Argon and Muse Wonder Full) on agentic tasks. It also excels at 3D modeling. The model is a 2.8T parameter mixture-of-experts with 104B active parameters and costs $2/$10 per million input/output tokens, which is half as much as Opus but substantially more than other Chinese models — DeepSeek-V4.1-Flash-1017 is up to ~17x cheaper per token. For the first time, Moonshot removed cyber-related data from mid-training and RL in order to intentionally weaken the model’s cyber capabilities, committing “not to release open weights that would extend the absolute frontier of cyber capability.” Full model weights will be released by Wednesday, November 4. OpenAI discloses more issues related to containment, monitoring, and alignment. On Tuesday, reasoning traces from GPT-6.1-Sol went viral for being (according to some) hard to read, a symptom of OpenAI’s chain-of-thought monitorability declining. On Wednesday, OpenAI’s Marcus Williams disclosed two cases of agents turning off misalignment monitoring in code it was working on. On Thursday, METR published a report on their and Redwood Research’s investigation of OpenAI’s internal agent monitoring systems in July and August, which they found woefully inadequate (though OpenAI has since worked on fixing these issues). On Friday, OpenAI disclosed an incident where a model escaped onto the internet during training, forcing them to pause frontier RL training and inference from September 20 to October 1. OpenAI no longer permits its models to have access to the live internet during training. Dario Amodei debates Nathan Calvin on Anthropic’s attitude toward AI safety. Calvin, the Chief Strategy Officer of AI safety/policy advocacy organization Encode, alleged on Monday that Anthropic is behaving like it’s trying to race to superintelligence before anyone else, rather than behaving responsibly on AI safety concerns, citing a long list of ways in which Anthropic has accelerated AI capabilities and acted irresponsibly on safety (such as by proposing a bill to the federal government that Calvin found weak). Dario Amodei made a rare public response on Tuesday, listing actions that Anthropic has taken that were both pro-safety and commercially costly. Calvin responded that while Anthropic has taken pro-safety actions on its own, it hasn’t done enough to “put RSI under robust societal governance.” Anthropic’s financials leak to the Wall Street Journal ahead of IPO. The company generated $16.3B in revenue in the first six months of 2026 and spent $9B on compute, up from $1.1B and $2.3B, respectively, in the first half of 2025, signaling greater compute-efficiency. It has over $600B in future compute obligations to companies like Google, Amazon, Microsoft, Broadcom, and neoclouds like Nscale and Lambda. It recorded a net loss of $80.7B in the first half of 2026, but the vast majority ($72B) was due to “change in fair valueof convertible notes and other instruments”, rather than business expenses. Anthropic could release its S-1 filing as soon as Monday. SpaceX reports Q3 earnings. Revenue was $14.6B, up 161% year-over-year. AI revenue is $7.56B, up 830% year-over-year, now the company’s largest segment. The first revenue-generating Starship mission launched in September, and Starlink revenue is now $5.25B, up 69% year-over-year. Elon Musk plans to bring 10 GW of compute and 20 GW of power and cooling online by the end of 2027, and SpaceX and Tesla have formed special committees to discuss a merger. Elon Musk doubts neocloud business models. He claims that rising cost of capital has made it harder for companies without investment-grade credit ratings to finance compute purchases. This includes almost all neoclouds, but not SpaceX, which has billions in revenue from Starlink and launches. Musk believes that “we’re going to see a lot of stranded compute in partially complete data centers” and “the 200+ neoclouds are going to see guppy-level death and consolidation.” OpenAI is raising $30 billion at a $1.25 trillion valuation ahead of its IPO, reportedly down from a targeted $1.4 trillion valuation. The financing is led by UAE investors as well as Coatue. Nothing has been confirmed by OpenAI yet. Kalshi currently expects OpenAI to announce its IPO in May 2027. DeepSeek is raising $15 billion at upwards of $75 billion. Investors include Chinese tech giants GigaDevice, Meituan, Geely, CATL, Tencent, Midea, and NetEase and private equity firms Boyu Capital, CPE, Legend Capital, and IDG Capital. DeepSeek is reportedly planning to begin its IPO process later this year. Startups raise a lot of money: Flapping Airplanes: $1B Series A at a $6B valuation. The year-old company with three co-founders in their twenties is working on more data-efficient training and inference methods for AI models. Tenstorrent: $1.5B Series E at a $6.2B valuation. The company, founded by legendary engineer Jim Keller, designs custom AI hardware and software to compete with Nvidia. Legora: $550M Series E at an $8.8B valuation, led by Gavin Baker’s Atreides Management. The company is a collaborative AI platform built for legal teams and law firms. ASI: $325M Series C at a $3B valuation. ASI (Air Space Intelligence, not Artificial Superintelligence), is a Boston-based company building simulation and monitoring software used in air traffic control, power grids, and military operations. Warp Sciences: $215M Series A to build automated scientific laboratories for drug discovery in America. Its CEO is Kevin Weil, former CPO and VP of Science at OpenAI. Arda: $230M at a $1.5B valuation to make software, and eventually robots, that automate manufacturing in America. Its CEO is Bob McGrew, former Chief Research Officer at OpenAI and the second engineer at Palantir. Eka Robotics: $150M Series A led by a16z and F-Prime. Eka is a Cambridge, Massachusetts based startup building vision models for general-purpose robotics, starting with dexterous manipulation. Town: $108M Series B at a $1B valuation. Town is building AI assistants for the enterprise. Each employee gets a Townie that can talk to other employees’ Townies and Anthropic publishes its first Public Benefit Report and announces its “five pillars” for success: the technical problems of AI safety are solved, AI safety is a universal practice backstopped by law, AI strengthens democracy and global stability, AI expands prosperity and human flourishing, and AI’s benefits are shared by everyone. Sam Altman privately discussed three AI future scenarios with employees: an “IAEA for AI” (a decentralized monitoring and advisory body without enforcement power), a “CERN for AI” (a centralized, government-funded single effort to build safe superintelligence), and “Eliezer [Yudkowsky]’s plan”, where one company or organization builds superintelligence first and uses it to disempower everyone else. Altman disavowed the third plan. AI safety advocates want to cap the compute that labs spend on AI R&D. Thomas Larsen, a researcher at the AI Futures Project, estimates that labs spend a majority of their compute on improving models’ capabilities, including the ability to automate AI research, and calls for mandatory minimum allocations of compute to safety research, monitoring, and inference for customers. Texas Attorney General Ken Paxton sues OpenAI and Sam Altman, alleging that OpenAI misleadingly marketed ChatGPT as safe, failed to disclose risks, harmed minors, and built rogue AI agents that hacked other companies. Nine other states (all red states), including Florida, have now sued the company. Anthropic and Citrini collab to design scorpion antivenom with Claude. Claude ran a 64-hour, $50k protein design campaign to select 180 designs, then Citrini synthesized them in a real wet lab, which took 39 days and cost $150. 17 of the designs ended up working. Anthropic previews Claude Duet, a proactive personal agent for iOS, Android, and web based on Opus 5.5, much like Meta’s Muse, OpenAI’s Dot, and SpaceXSI’s Grok Bot. The UK Government announces the AI Biosecurity Lab, partnering with DeepMind to “help the UK better understand, prevent, detect and respond to biological threats,” with $400M of funding. Amazon CEO Andy Jassy says AWS is largely sold out of compute capacity for 2027, as well as “a good chunk of ‘28.” DeepSeek open-sources DeepInfer, the inference framework behind DeepSeek-V4.1-Flash-1017. humans& releases Ampersand, a model designed to collaborate with humans and learn from interaction. Apple releases the iPhone Duo, its first-ever folding iPhone. It’s sold out almost everywhere despite starting at $1,999 and having some issues with build quality. Claude Code leads Thariq Shihipar and Anthony Morris leave Anthropic. Aleksander Madry rejoins OpenAI to work on alignment with Chief Scientist Jakub Pachocki. Dr. Christopher Stubbs joins Anthropic’s Long-Term Benefit Trust. Dr. Stubbs is a professor of physics and astronomy and former Dean of Science at Harvard. Demis Hassabis shortens his AGI timelines from 3-5 years to 2-3 years. Written by @theojaffee

   Open source
8. TE

   TechmemeArticle · 5d ago

   PHP releases security fixes for two critical unauthenticated RCE vulnerabilities, affecting all web request-serving installations, and urges PHP users to update (PHP) PHP : PHP releases security fixes for two critical unauthenticated RCE vulnerabilities, affecting all web request-serving installations, and urges PHP users to update — PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix two critical vulnerabilities that can allow unauthenticated remote code execution.

   Open source
9. WB

   Wu Blockchain@WuBlockchainPost on X · 5d ago

   Critical PHP Vulnerabilities Spark Global Security Alert; SlowMist Warns Crypto Exchanges, DeFi Platforms and Wallet Providers SlowMist said its MistEye threat intelligence system conducted a global scan of PHP-related assets across the crypto industry following the disclosure of two critical remote code execution vulnerabilities, CVE-2026-109618 and CVE-2026-109619, both rated 9.2 under CVSS v4.0. The flaws could allow unauthenticated attackers to execute code on affected servers under certain conditions. PHP released security patches on October 21, covering versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35. SlowMist urged crypto exchanges, DeFi platforms, and wallet providers to assess their exposure and apply the updates promptly.

   Open source
10. C�

    CZ 🔶 BNB@cz_binancePost on X · 5d ago

    Call me paranoid, but be extra careful visiting ANY web site in the next few days, as some web admins are not always up-to-date with security patches. Two vulnerabilities (CVE-2026-109618 and CVE-2026-109619) reported for PHP, the web programming language, affecting servers running popular apps like WordPress and Magento, with patches released October 21, 2026 after details leaked early. Exploitation was confirmed in the wild soon after disclosure, prompting quick WAF protections and patching by IT teams, as unauthenticated attacks could turn visited sites into vectors for credential theft or device exploits. Stay SAFU!

    Open source
11. UT

    USA TODAY@USATODAYPost on X · 5d ago

    PHP, a programming language that powers as much as 70% of the world's websites and web applications, disclosed two critical security issues on Tuesday, Oct. 20, that could leave it vulnerable to hackers. The issues would allow bad actors to steal information or launch a cyberattack on anyone visiting a hacked website. PHP software powers WordPress, Drupal, Joomla, and Magento websites, according to a blog post by Huntress cybersecurity researcher John Hammond. "When a critical bug lands in PHP itself, rather than in one app built on top of it, the number of places you have to go looking to identify vulnerable PHP versions gets very big, very fast," he wrote. Get live updates at: https://t.co/jXDYKnhVvh

    Open source
12. PR

    ProtosArticle · 5d ago

    Remotely exploitable PHP bug found on 70% of world’s websites A bug that allows hackers to remotely execute code has been discovered in PHP, the language that powers 70% of the world’s websites. PHP shipped emergency fixes today for two of the most critical flaws, but over one-third of the web remains unpatched as of publication time. The language, used to program website backends, runs on servers, not in the browser, and sends its resulting HTML or other dynamic data to the browser. Official fixed releases only cover PHP 8.2 and newer, leaving over one-third of PHP websites without a patch. Mid-day, backports were starting to roll out across older versions 7.4-8.1. Unfortunately, according to one estimate , more than 800,000 internet hosts serving content to millions of websites run a branch of PHP so old “that will get no fix” at all. The two flaws, CVE-2026-109618 and CVE-2026-109619, are collectively PHP2Shell. PHP2Shell lets an unauthenticated attacker run code on a web server and serve buggy outputs to a user’s browser. Hackers’ exploits can occur even before a website’s own code executes. Abandoned DeFi websites used to host crypto wallet drainers Read more: Whitehat hacker accuses Injective of ghosting after $500M bug disclosure AI hacked PHP, found a bug affecting most websites A security researcher using OpenAI’s GPT-5.6 Sol model discovered the bug during an August audit funded by OpenAI. That researcher was part of Calif, a partner in OpenAI’s Patch the Planet program, which pairs frontier models with expert human cybersecurity review. The bug class had been flagged decades earlier yet dismissed as too hard to exploit, Calif’s CEO Thai Duong told the Wall Street Journal . However, AI hackers have now figured out how to seize control of a server’s memory within a few dozen requests. Wiz, a division of Google Cloud, confirmed the flaws independently. Wiz’s co-founder called PHP2Shell “the most severe AI vulnerability that was ever found,” and one humans would probably never have found. Cloudflare reacts as PHP alarms ring around the world Cloudflare’s CTO Dane Knecht reported live exploit vectors for every customer, including free plans. The website cacheing giant implemented a stopgap emergency measure overnight before announcing more patches a few hours later. *FINLAND SHUTS STATE INTERNET SERVICES OVER PHP FLAWS *NETHERLANDS CYBERSECURITY AGENCY TAKES WEBSITE OFFLINE OVER PHP FLAWS *FRANCE TEMPORARILY TAKES PREFECTURE WEBSITES OFFLINE PENDING PHP FIX: MINISTRY https://t.co/mi9GbPXmOK — *Walter Bloomberg (@DeItaone) October 21, 2026 The PHP bug had worldwide impact. Finland’s state IT center shut several government web services as a precaution. Meanwhile, in the Netherlands, NotuBiz’s council information sites for local governments went offline, with MijnOverheid and the Dutch parliament’s site follo w ing . Patched versions of PHP include 8.5.12, 8.4.27, 8.3.36, and 8.2.35. However, 27% of PHP sites still run PHP 7, and 7.7% run PHP 5, which remain unpatched. GoDaddy urg e d customers to upgrade. Got a tip? Send us an email securely via Protos Leaks . For more informed news and investigations, follow us on X , Bluesky , and Google News , or subscribe to our YouTube channel. The post Remotely exploitable PHP bug found on 70% of world’s websites appeared first on Protos .

    Open source
13. CO

    Cointelegraph@CointelegraphPost on X · 3d ago

    🇺🇸 ALERT: The FBI urges organizations to immediately patch two critical PHP vulnerabilities that could let attackers breach systems, or take affected systems offline until secured. https://t.co/GSVv7pZudl

    Open source
14. OP

    OpenAI@OpenAIPost on X · 5d ago

    OpenAI models helped researchers—operating as part of our Patch the Planet initiative—discover critical security flaws in PHP, an open-source programming language used to run an estimated 70% of websites. Over the past two months, we led a coalition of maintainers, researchers, and security providers to prepare fixes and protections ahead of disclosure. This duration was necessary because the fix was quite intricate and required a major change to the PHP engine. Every site using PHP can now safely upgrade their version to stay secure, in addition to applying mitigations from various security vendors. Due to the severity of these flaws and PHP’s widespread use, we consider this bug to be one of the most impactful vulnerabilities in recent memory. It also marks a new phase, where AI can find security bugs with internet-scale impact. This is an example of the Defender’s Window in action: to our knowledge, frontier AI was able to find this vulnerability ahead of attackers, giving defenders time to prepare. https://t.co/TW3jrSbB3f

    Open source
15. MT

    MTS@MTSlivePost on X · 5d ago

    SITUATION DETECTED: Critical PHP vulnerabilities were discovered with the help of GPT-5.6 Sol. OpenAI says these are among several significant vulnerabilities they have found and are working to fix, and they expect similar findings to "increase sharply" in the coming months.

    Open source