It’s been a long week for cyber defenders. Two critical vulnerabilities in PHP could affect up to 70% of all websites, and governments have been urging operators to either patch or go dark. Exacerbating the stress for website owners, researchers disclosed that an Indian certificate authority has been using easy-to-guess keys that enable malicious actors to impersonate valid servers in order to intercept traffic. This could affect more than 60 million websites. Rounding out the week, Microsoft reported on a China-state aligned hacking campaign that leveraged agentic AI to increase the speed and scale of exploitation.
What should policymakers take away from this week? Is this a manifestation of the so-called “AI-powered vulnpocalypse” that has been heralded over the past year? What does clean up look like across each of these three distinct incidents (not to mention LiteLLM and the Node.js vulnerability)? Join experts from IST’s Center for Advancing Cybersecurity and the broader ecosystem as we unpack the week that was.
Panelists:
