Meta found a way to raise AI money without giving up control, and the price includes keeping its founder in one state. Elsewhere, the security news is worse than usual: attackers were reportedly already working on PHP before most defenders heard about the bug.
1. PHP2Shell attacks reportedly began before anyone was warned
The uncomfortable part of PHP2Shell is the timeline. The Register’s headline says AWS revealed that attacks began before the vulnerabilities were disclosed. For some defenders, the first alert came after the exploitation had already started. The text we have is only that headline, so it doesn’t say how early the attacks began or how many systems were hit.
TechCrunch shows how seriously officials took it. Reuters reported government websites around the world going offline after AI discovered critical PHP vulnerabilities. The NSA told organizations to update immediately or take their PHP systems offline until they could. That is an odd instruction for a security agency, because it treats downtime as the safer default.
My read is that “patch fast” isn’t a complete plan when exploitation can precede disclosure. If you ran exposed PHP, patching closes the hole, but it doesn’t tell you whether someone used it first. Neither source says how many systems were compromised before patches arrived, and that is the number that matters.
2. eMudhra defends keys The Register calls laughably weak
The Register reports that certification authority eMudhra is defending its private keys, which the outlet calls “laughably weak.” The only text available here is that headline, so we can’t say what exactly is wrong with the keys or what eMudhra’s defense argues.
The stakes are clear even so. A CA’s private key is the secret that lets someone issue certificates browsers will trust. If it can be guessed, the trust the CA sells is gone. That makes the defense itself the story. If eMudhra is leaning on having followed the rules, the real question is what those rules actually test.
3. Meta’s AI stock plan ties Zuckerberg’s liquidity to California
Mark Zuckerberg can sell most of Meta’s new shares only if he keeps living in California. According to a company filing reported by WIRED, the clause exists because he told board members on September 9 that he was considering leaving over Proposition 40, a one-time 5 percent tax on billionaires’ assets.
The shares are a new non-voting class, distributed to existing shareholders as a stock dividend. CFO Susan Li said the class can be used for capital raising, employee compensation and acquisitions while preserving the voting power of Class A and B holders. Under the “Founder Alignment Agreement,” Zuckerberg can sell 20 percent to cover taxes. He can sell the rest in chunks over eight years if he stays. Selling early would require giving up some voting shares.
One instrument solves two problems. Meta reported $64 billion in revenue, up 26 percent, while costs rose 68 percent. Non-voting stock lets it fund that gap without diluting founder control. The residency lock is leakier than it sounds, since it only requires Zuckerberg to live wherever Meta is headquartered. And polling suggests Prop 40 will fail, so the handcuffs may outlast the threat.
4. Power limits and relentless scanners are reshaping Git and the WAF
GitHub’s migration story has a revealing constraint: a hard ceiling on power capacity in its data centers and surrounding region, plus supply chain limits. Add agent-driven traffic growth, and the Azure move had to be fast. Nearly every repository now lives in both places, and Azure serves about half of Git traffic.
The holdouts are the busiest repositories. Every write holds a repository-wide lock, and a roughly 25ms cross-region round trip makes that painful. GitHub’s fix is to serialize per reference instead of per repository, so agents and developers pushing to different branches stop queueing behind each other. In internal testing, writes to different references saw 3–4x higher throughput. GitHub says the next limit is write throughput and promises more at Universe.
Cloudflare is solving a different problem under similar pressure. Its new full transaction detection checks a request together with the origin’s response, citing persistent AI scanners that adapt payloads from feedback. It’s available on all plans, but custom response rules are capped at three. It also can’t undo what the origin already did.
5. Spotify tightens the Family Plan while Europe loosens Meta’s ads
Spotify’s co-CEO Alex Norström calls its QR-code Family Plan check a “routine improvement,” not a crackdown. The mechanics are stricter than that. A member has seven days to scan a code on the plan manager’s phone. Miss the window and you can’t join another Family or Duo plan for 12 months. You’d need an individual plan. Norström said the company will keep closing holes as they appear.
Meta faces the opposite pressure. Its European ad revenue grew 18 percent last quarter against 33 percent in the US and Canada. Meta has offered Less-Personalized Ads there since the start of the year, after EU regulators found it in breach of the Digital Markets Act and fined it €200 million. Meta didn’t explicitly blame the option this time, but CFO Susan Li warned about it in July. A Rothschild & Co Redburn analyst believes it is contributing.
The two aren’t one trend. Spotify picked its fix and can ship it. Meta had its fix imposed and must win the lost efficiency back through better modeling. Meta doesn’t disclose how many users chose each option, so the size of the effect is still an estimate.
