Companies like Google, Netflix, TikTok, and Meta may soon owe the French government, reports Tom's Hardware: France has approved a proposed tax that aims to tax the amount of internet data per gigabyte sent to French users in the country... According to minutes released by the National Assembly, members voted 11-10 in support of the motion on October 30 — which now means the new law has been added to the country's next budget, despite major opposition from the government side and the finance committee rapporteur. The latest amendment, introduced by socialist lawmaker Laurent Lhardit, could see content providers pay €0.055 (roughly $0.06) to the government for every gigabyte of content distributed to French users. With approximately 154 million users and counting in France, the proposal's authors say such a tax could generate around €10 billion ($11.2 billion) in annual revenue for the government. The said proposal, though yet to be passed as it must survive further parliamentary scrutiny, aims at companies that generate substantial internet traffic as opposed to taxing their advertising revenue, profits and subscriptions. Its explanatory notes particularly mention Google, Meta, Netflix, Amazon, and content delivery network Akamai as major potential contributors. Notably, TikTok and other similar platforms could fall under this broader scope depending on how these rules are applied. Internet service providers, including Orange Free and Liad, would be required to measure the volume of data and identify the companies responsible for sending it to French users. The Data will then be collected and submitted quarterly to France's tax administration under the supervision of telecommunications watchdog Arcep. The measure becomes law if it clears the remaining stages of France's budget process, the article points out, "with parliament scheduled to vote on the budget's first section in early November." "VideoLAN, the French nonprofit organization behind the VLC media player, warned that the proposed levy could cost it more than €1 million annually," reports CircleID. "Its response illustrates how traffic-based taxation could affect organizations distributing large volumes of data without corresponding commercial revenue."

Read more of this story at Slashdot.

Canada is joining the European Union's supercomputing network to give Canadian companies, startups, and researchers access to European computing resources for AI development. The partnership aims to strengthen AI cooperation and reduce dependence on US technology. Politico reports: The EU's supercomputing network is run by the EuroHPC Joint Undertaking, an EU public-private vehicle with an 8.2 billion-euro budget. The network consists of 14 supercomputers (some ranked in the global top 10), 19 AI-focused AI factories and 10 quantum computers. The vehicle will also run seven massive AI data center hubs, known as AI gigafactories, set to be built next year with a total investment cost of 30 billion euros. Experts praised a possible EU-Canadian compute power team-up, but warned it's only the start. "Compute cooperation is one of the most obvious short-term 'middle power' cooperation plays in AI," said Anton Leicht, technology and international affairs fellow at Carnegie Endowment for International Peace. But he added that for now "it doesn't put a dent into the actual dependence" on the U.S. "As long as the U.S. builds gigawatt-scale clusters, no amount of cooperation that doesn't result in massive buildouts will help," he said. Canada's engagement in the EU's supercomputer network builds further on Canada's previous partial involvement in the EU's flagship research and development program, Horizon Europe. Horizon Europe partially funds EuroHPC. To date, 38 countries have participated in the EU's supercomputing network: 27 EU member countries plus non-EU countries including Norway, Switzerland, the United Kingdom, Israel and Turkey.

Read more of this story at Slashdot.

The PHP project released patches Wednesday for two critical vulnerabilities in a programming language used in an extremely large portion of the internet.

The patch addresses two flaws, catalogued as CVE-2026-109618 and CVE-2026-109619, both rated 9.2 on the CVSS v4.0 severity scale, which tops out at 10. Researchers describe them as remote code execution vulnerabilities, which could let an attacker run their own code on a server and potentially take control of it. 

The vulnerabilities have been dubbed “php2shell” by researchers. While the industry has spent the past 24 hours sounding the alarm over the vulnerabilities, there has been very little in terms of reported exploitation as of Wednesday afternoon.

In a release, the Cybersecurity and Infrastructure Security Agency said it wasn’t aware of any exploitation.

“While CISA has not observed exploitation of these vulnerabilities as of the time of publication, they pose a risk to organizations if left unpatched,” the release reads.

Multiple researchers have told CyberScoop that they have observed very little activity outside of reconnaissance that is probing to see what vulnerable systems are still connected to the internet.

“We see clear evidence attackers are actively probing and performing reconnaissance across PHP applications,” Kelly Shortridge, chief product officer at Fastly, told CyberScoop. “The gap between disclosure and widespread, repeatable exploitation is typically hours to a few days for vulnerabilities of this severity and attack ROI.”

“We have not observed, or independently confirmed, successful in-the-wild exploitation of these vulnerabilities on live customer systems,” Jon Semon, principal security operations analyst at Huntress, told CyberScoop.

“We have checked across the Linux web servers we have visibility into for the post-exploitation behavior shown in the public proof of concept, such as a web server process spawning a shell that runs recon commands or writes a file into the web root, and did not find activity matching it.”

Neither the technical cause nor a complete list of affected versions has been officially confirmed, with the PHP team saying full details will be published with the release. An advisory from CERT-EU, the European Union’s computer emergency response team, says the flaws could affect every version of PHP from 5 onward. 

The security firm watchTowr said Tuesday the vulnerabilities had been set for release Thursday under embargo. The PHP team moved the release up a day and said it could act sooner still if details became public or exploitation appeared.

A video demonstrating an exploit chain spread online overnight via researcher Kirill Firsov, who shared it and credited researchers known as LCFR and Calif.io. watchTowr said it had reproduced one of the flaws. Code claiming to exploit the flaws is circulating but has not been verified, and security firms caution such code is sometimes laced with malware.

The potential exposure is broad. PHP runs between 70-80% of websites whose server-side language is known, according to market research, and underpins platforms including WordPress, Drupal, Joomla and Laravel. Researchers estimated more than 1.3 million internet-exposed hosts could be vulnerable, and a Shodan search counted about 1.9 million. Among servers that disclose their version, most run branches are no longer receiving security updates: about 758,000 run versions from 5.4 through 8.1, compared with 272,000 on supported branches, according to VirusTotal.

CERT-EU and Britain’s National Cyber Security Centre advised organizations to prepare to update systems quickly and suggested isolating internet-facing applications where immediate patching was not feasible. PHP flaws have been exploited before: the U.S. Cybersecurity and Infrastructure Security Agency’s known-exploited vulnerability catalog lists three in PHP itself, two used in ransomware campaigns.

The vulnerability was discovered by AI cybersecurity firm Calif, using OpenAI’s cybersecurity-focused AI model GPT-5.6 Sol. Wiz, an AI security firm purchased by Google in March, also independently discovered and reported the flaw, according to a blog posted by OpenAI on Wednesday.

The discovery sparked a two-month collaborative effort between OpenAI, PHP maintainers, researchers and security providers to develop a long-term technical fix and prepare for public disclosure.

OpenAI said the priority for all organizations relying on PHP is to apply the new patches, and offered a free tool and other support to help identify vulnerable versions.

“To our knowledge, frontier AI found these vulnerabilities before attackers did, opening a Defender’s Window for maintainers and security providers to prepare fixes and protections ahead of disclosure,” OpenAI wrote in an unsigned blog.

OpenAI also said the PHP flaw is among “several significant vulnerabilities we’ve already found and are working to fix, and we expect similar findings to increase sharply in the coming months.”

In a blog posted the same day, researchers at Wiz said they had discovered “multiple critical vulnerabilities” in PHP, all related to memory safety using GPT-5.6 Sol, their own Wiz Atlas AI tool and Google’s Gemini 4 Argon to conduct their research.

Perhaps most concerning: The bug existed for decades prior to the emergence of modern AI tools, but it’s so complex and technically arduous that few attackers were likely capable of exploiting it.

According to Wiz, it required developing exploits for “notoriously complex” memory bugs that work across different PHP versions, configurations and application behaviors. It would also have to account for differences in PHP deployments that could render the exploit harmless, and each change would require more testing, analysis and debugging.

In the era of AI hacking, “this is no longer a barrier,” the Wiz researchers said.

Large language models can adapt exploits to different PHP versions, configurations or memory layouts, use third-party testing and debugging tools, and carry out a series of other functions for “reducing the specialist effort required for each target.”

“This changes the economics of both discovery and exploitation,” wrote Wiz researchers Sagi Tzadik, Shir Tamari, Nir Ohfeld and Tomer Schwartz. “As AI reduces the effort needed to develop and adapt complex exploits, vulnerabilities that once seemed impractical to exploit become viable targets.”

More information is expected over the course of the day. The PHP team is to publish the full advisory with the release, and security firms including Huntress and Tenable said they would update their analyses as technical details and proof-of-concept code emerge.

UPDATE: 10/21/2026, 3:00 p.m. ET: This article was updated to include infromation from CISA and from industry researchers.

The post PHP releases emergency fixes for 2 critical vulnerabilities appeared first on CyberScoop.

A study commissioned by CCIA Europe, whose members include Amazon, Google, and Meta, estimates that the EU's proposed Cloud and AI Development Act could impose 115 billion euros ($128 billion) in costs over a decade as governments and companies migrate workloads and rewrite software. The figure is more than six times the European Commission's upper estimate. However, roughly 80 billion euros ($89 billion) of it comes from a modeled scenario assuming sovereignty rules are extended to 25% of cloud workloads in essential private-sector industries.The Register reports: The report specifically targets Article 31 of the proposed legislation, which it says could allow the Commission to extend sovereignty requirements into essential private-sector services. CCIA argues that forcing businesses to move away from existing cloud infrastructure could trigger expensive software redevelopment projects, with code rewriting and re-architecting accounting for 69 percent of its estimated costs. Luxembourg would apparently take the biggest hit, with the study putting the cost at 1,711 euros per worker over ten years. Denmark (905 euros), Austria (900 euros), and Finland (864 euros) also face hefty bills, as does Ireland (856 euros), which hosts the European headquarters of several US tech giants. CCIA is urging EU governments to overhaul the proposed legislation, limit sovereignty restrictions to sensitive workloads, and abandon requirements based on corporate origin or personnel nationality in favor of what it calls risk-based technical safeguards. "Member States cannot rely on the Commission's incomplete estimates when deciding CADA's strict sovereignty requirements for cloud and AI providers," said Mitchell Rutledge, CCIA Europe's policy manager. "Taxpayers and businesses will foot the bill, yet the official assessment missed 70 percent of CADA's true impact." For AWS and Google, offering European customers greater control over their data also helps retain business that might otherwise migrate to European competitors. It's a rather convenient arrangement: sell customers sovereignty on one hand, while an industry association representing your interests warns governments against imposing too much of it on the other.

Read more of this story at Slashdot.

Politico EU reports: The European Commission has rolled out an alternative to Microsoft Teams — but officials using it aren't impressed, with one describing the tool as "absolute shit." The Commission introduced Element Pro over the summer as a "sovereign back-up to Teams," according to an internal staff memo seen by POLITICO. The platform is intended to provide a fallback for Commission communications if U.S.-based Teams becomes unavailable.... But three officials have questioned why the Commission needs the new system — and whether it works well enough to serve as a genuine backup. "I don't understand the added value here," one official wrote on an internal staff message board, seen by POLITICO. Another described the tool as "absolute shit." A third official said that, judging matters on how well Element Pro works compared to Teams, the U.S. would "instantly win the war" if it ever decided to switch off its technology... The Commission hosts the Element system on its own infrastructure rather than relying on Microsoft's cloud. That gives the institution greater control over its communications data and systems... Element is a U.K. company whose software is used by governments and public-sector organizations in Europe... Element CEO Matthew Hodgson told POLITICO in a call using Element software that the Commission is still trialing it. "Obviously there are going to be some teething issues," he said, adding there will always be "cognitive dissonance" when switching to a new app, if only because the "buttons" are in a different place. He noted that the United Nations and NATO also use Element Pro. The article adds that earlier this year, France announced millions of civil servants will switch to home-grown alternatives to American video-conferencing tools including Microsoft Teams and Zoom by 2027, while Austria's military also replaced Microsoft Office with the German-made LibreOffice last year.

Read more of this story at Slashdot.

The European Commission has rolled out Element Pro as a self-hosted "sovereign back-up" to Microsoft Teams and the reviews aren't great. Politico reported that several officials questioned its usefulness and usability, with one calling it "absolute shit." Politico reports: "I don't understand the added value here," one official wrote on an internal staff message board, seen by POLITICO. Another described the tool as "absolute shit." A third official said that, judging matters on how well Element Pro works compared to Teams, the U.S. would "instantly win the war" if it ever decided to switch off its technology. All the officials were granted anonymity to speak freely. The Commission hosts the Element system on its own infrastructure rather than relying on Microsoft's cloud. That gives the institution greater control over its communications data and systems. "That is not the case with Teams, where all we have is a guarantee that Microslop will not peek inside," a fourth official wrote, presumably referring to Microsoft, in internal communications viewed by POLITICO. Element is a U.K. company whose software is used by governments and public-sector organizations in Europe. The application works much like Teams, allowing staff to hold "audio and video calls with Commission colleagues, send and receive files, and create dedicated 'rooms' for projects and conversations, much like chats and channels in M365 Teams," according to the Commission memo. "Obviously there are going to be some teething issues," said Element CEO Matthew Hodgson, adding there will always be "cognitive dissonance" when switching to a new app, if only because the "buttons" are in a different place. He noted that the United Nations and NATO also use Element Pro. "Change is always painful, particularly if it's a switch from a much-used program like Teams."

Read more of this story at Slashdot.

The European Commission "proposed on Thursday banning children under 13 from social media, with parent-supervised accounts until 15," reports Reuters. "Enforcement would rely on a tool Brussels built itself" — a free, open-source age verification smartphone app "that tells a platform whether a user meets an age threshold without revealing their identity..." If passed, the proposed Kids Act would create the world's largest social media access restriction, covering 450 million people across 27 countries... [The EU-built age-verification app] is being rolled out through member states, with seven pilot countries: Cyprus, Denmark, France, Greece, Ireland, Italy and Spain. The Commission expects EU-wide availability by the end of 2026. It will also be used to prove users are over 18 when accessing adult sites, a restriction already implemented under the Digital Services Act... [T]he system itself is decentralised. Member states run it through issuers they designate, and the proofs live on the user's phone. There is no central EU database of ages or of who verified whom... A user proves their age once to a nationally designated issuer — a body vetted by the member state, which can be a digital ID provider, a bank or a post office. At a restricted site, the app certifies that the user is above the required age threshold. The platform receives only a yes-or-no response. Issuance and verification are handled by separate entities. The proof provider is not told which service the proof was used for. Each proof works only once, preventing cross-service tracking. No identity documents or biometric data are retained. The code is open-source, allowing independent scrutiny. The significance of the EU approach is that it provides a common age-verification mechanism rather than leaving individual platforms to develop and enforce their own systems. "Online platforms can easily rely on our age verification app. So there are no more excuses," [EU Commission President Ursula] von der Leyen said... The proposal must be approved by EU member states and the European Parliament before becoming law. Non-compliance would risk fines of up to 6% of a tech company's global annual sales, plus supervisory fees, Reuters reported earlier. The EU's plan follows similar initiatives in Australia, Britain, China, India, Turkey and several European Union countries.

Read more of this story at Slashdot.

French entrepreneur Helene Huby is emerging as one of Europe's most ambitious space leaders, with The Exploration Company raising a record $450 million Series C as it develops the Nyx cargo capsule, a crewed spacecraft, and a reusable heavy-lift rocket. Huby argues Europe risks falling irrelevance without a much larger rocket flying at high cadence. Her company is targeting a 400,000-pound-thrust methane engine test by 2028 and an aggressive 2033 timeline for the launcher. Ars Technica reports: "The fundraise we have done right now is not sufficient to build the massive rocket we have in mind, so there will be another fundraise," she said. "Right now, we're going to be very, very focused on the execution. We must dock with the space station, with the capsule, as fast as possible. We must build this rocket engine and de-risk it as fast as possible. I think once one of these two milestones is achieved, we'll be talking fundraise again." Critics may look at Huby and her company and say that is a lot of big talk for a company that only has a single, partial success in spaceflight to its credit. And sure, it is. But that's kind of the point. So much of the spaceflight community in Europe has been concerned with either the large aerospace primes seeking government handouts to protect their turf or small launch startups. There has been a stunning lack of big, visionary thinking. Few people on the continent seem to recognize that multibillion investments by US companies such as SpaceX, Blue Origin, and Amazon in space, and their many imitators in China, are radically transforming spaceflight. As the world changes, Huby does not seem willing to stand on the sidelines in Europe and bemoan capitalism in space. Rather, she seems to be saying it is not too late for Europe to seize the day. "We need to have European politicians who are ambitious," she said. "Entrepreneurs cannot do this alone. We need to be backed by the politicians and by the European Space Agency. But we have to start by achieving the crazy targets that we've set up for ourselves. That will give trust to others to believe in what we're doing."

Read more of this story at Slashdot.

Google says it will overhaul Search in Europe to comply with the EU's Digital Markets Act, giving more prominence to comparison services like Expedia and Hotels.com while stripping some real-time features from hotel, airline, and restaurant results. "These changes degrade the user experience for Europeans -- boosting online intermediaries at the expense of local businesses, and removing helpful features people rely on every day," said Nick Fox, senior vice-president of knowledge and information at Google. The company claims its past search changes for DMA compliance were tied to a 30% decrease "in free, direct booking traffic to European businesses." Engadget reports: That sanction was the latest salvo between the EU government and a US tech company for infringing on its Digital Markets Act. The debate centers on the DMA requirement that major tech brands "must not treat their own services more favorably in ranking than third-party services." [...] According to Reuters, Google's revised search results "will highlight one specialized search engine at the top of the page, followed by two others with fewer details. A carousel of hotels, airlines and restaurants, for example, will sit below them with key features such as real-time prices stripped out." Those specialized engines include sites like Expedia or Hotels.com, also known as vertical search services, so European users may soon see those aggregators and comparison sites prioritized more highly than individual businesses' websites in their results. Reuters noted that "the rankings will be determined by Google's algorithm," meaning the tech company still holds a lot of control over how results are displayed. The EC had given Google 60 days to comply with its rules, but the company has not specified an exact timeline for when European users will start seeing the changes.

Read more of this story at Slashdot.

Switzerland has a population of 9,154,242. And its federal government just launched a pilot program to test open source alternatives to Microsoft 365 on 3,000 workstations, reports the blog It's FOSS. "That's about 7% of the federal workforce." The target is to complete the migration by end of 2027... On September 3, 2026, the Federal Council published results of "PoC BOSS", a feasibility proof-of-concept involving 172 federal employees who tested the openDesk suite, a German open-source collaboration platform. During the proof-of-concept phase, core office tasks like document processing and email received positive assessments, while large-scale video conferencing still showed technical limitations. Based on the 'success' of the PoC phase with 172 employees, the pilot is now launched for 3,000 employees... According to Matthias Stürmer, professor at the Bern University of Applied Sciences, Microsoft's supremacy in public institutions poses three problems that are driving this migration. First is the risk of foreign access. US cloud legislation could expose Swiss government data to foreign authorities. Second is the risk to service continuity, as dependency on a single foreign vendor creates operational risk. The third risk is the escalating costs as proprietary licensing fees are rising with no Swiss leverage. Switzerland's military cybersecurity unit, Cyber Command, is not waiting for the civilian pilot. It is already poised to replace Microsoft 365 entirely with openDesk by October 2026. It is pretty much the same reason. Military doesn't want foreign governments accessing sensitive Swiss data. The article notes that during the pilot phase, the new system runs in parallel with Microsoft 365 rather than replacing it. But the article's author speculates that "If the pilot is successful, we might expect the migration to continue on all the 54,000 workstations owned by the federal administrations."

Read more of this story at Slashdot.

Russian state-sponsored hackers are breaking into critical infrastructure around the world by exploiting poorly configured and vulnerable networking devices, authorities from the United States and 12 additional countries said in a joint cybersecurity advisory Monday.

Officials once again urged defenders to take more preventative measures to thwart attacks from the Russian Federal Security Service Center 16, which has been actively targeting critical infrastructure for more than a decade. The hackers are also tracked as Berserk Bear, Energetic Bear, Crouching Yeti, Dragonfly, Ghost Blizzard and Static Tundra.

“This is an ongoing issue that has impacted various U.S. and foreign networks across multiple sectors, including the defense industrial base, communications, energy, financial services, government facilities and health care sectors,” the National Security Agency said in a statement.

The state-sponsored attackers scan the internet for vulnerable routers using default or weak passwords, and have also exploited vulnerabilities in Cisco devices, Cisco’s Smart Install feature and web portals to take over network devices. 

Two of the Cisco vulnerabilities exploited by the Russian FSB Center 16 hackers are quite old, including CVE-2008-4128 and CVE-2018-0171. 

Officials shared technical details of the threat group’s activities and advised network defenders to disable Cisco Smart Install on all devices, use stronger modes of authentication and passwords, monitor for unusual credentials and logins using local accounts. 

The joint advisory comes nearly a year after the FBI issued a similar alert about the same group targeting end-of-life networking devices running Cisco Smart Install. 

On Monday, the European Union blamed Russia’s FSB Center 16 for a December 2025 attack on Poland’s energy grid. The United Kingdom, also on Monday, sanctioned 24 individuals and entities allegedly involved in various attacks attributed to Russian intelligence services.

“From directing criminals to targeting businesses, and striking Poland’s energy grid in the depths of winter, the Russian state is sinking to new lows in its attempts to undermine European security,” Yvette Cooper, foreign security of the United Kingdom, said in a statement. 

Other countries behind the joint cybersecurity advisory include: Canada, Australia, New Zealand, Czech Republic, Denmark, Estonia, Finland, France, Italy, Poland and Sweden.

The post Officials once again warn defenders that Russian hackers are targeting network devices appeared first on CyberScoop.