Today’s briefing:
— Why the internet almost broke
— Will Lula catch Bolsonaro?
— London’s new favourite pastime
Your Insider’s briefing:
— Why the internet almost broke
— Will Lula catch Bolsonaro?
— London’s new favourite pastime
Good morning {{first_name | Intriguer}}. You might recall yesterday we looked at Canada’s strategic maple syrup reserve, then casually and confidently exhorted Hollywood to, and I quote, “immediately write a heist comedy starring both Canadian Ryans (Reynolds and Gosling) as two rogue sap-smugglers pulling off one last high-stakes, sticky job to save the reserve from an evil, cigar-chomping pancake chain executive played by JK Simmons.”
I’d now like to thank the roughly 50% of the population of Canada for then sliding into our DMs to politely (per Canadian cultural norms) point out that a) this heist already happened, and b) none other than Jason freakin’ Blum himself (with Jamie Lee Curtis) already adapted it to the screen. Should’ve cast JK Simmons though.
Now without further ado (though saying “without further ado” is literally just adding additional ado), let’s look at the bug that almost broke the internet.
 | Managing Editor Jeremy Dicker |
🍸 Prefer a weekend recap? Become an Intrigue Insider today!
Number of the day
25%
That’s how far shares in US biotech pioneer Moderna just crashed after someone leaked the results of its highly-anticipated late-stage melanoma vaccine trial with Merck. The trial actually revealed a big drop in the cancer’s recurrence, but not enough to justify the stock’s epic year-to-date rally.
Couldn’t hack it
That’s Rasmus Lerdorf, the creator of the 1990s-era PHP language still running ~70% of all websites.
We've all seen the disaster movie moment where the control-room starts flashing red and JK Simmons (yes) yells "take it offline!"
Well that's more or less what just happened, except the control-room was the internet, and JK Simmons was half the world's governments.
So what — and we cannot stress this enough — just happened?
First, the location: it all went down in a digital world called PHP, which once stood for Personal Home Page but is now a backronym for PHP Hypertext Preprocessor. A Greenland-born coder (Lerdorf above) created the script back in the 90s, and it went on to become the unglamorous plumbing for ~70% of all websites!
For decades it all relied on an informal hobbyist network until some tech firms financed the PHP Foundation from 2021, paying a small team to tend the code.
And one of those nerds then actually found a weird memory issue in 2024, but it all seemed way too complicated for anyone to exploit, let alone fix, until...
Second, the reveal: fast forward to August 2026, and security researchers at Calif (a startup) and Wiz (Google) started aiming powerful new AI models at PHP's code. And sure enough, what humans first dismissed as a jumble of harmless memory quirks, AI quickly identified as a massive 'PHP2Shell' vulnerability, triggering...
Third, the race: those researchers quietly tipped off the PHP Foundation, starting a frantic, confidential two-month race to rewrite the code and patch the hole before any villains got wind. And it was all going to plan for an orderly global update until...
Fourth, the leak: back on Tuesday, 48 hours before the PHP Foundation’s planned roll-out, someone leaked key details, then some more. Who and why? PHP had given a heads-up to key plumbers (think software maintainers and Linux distributors) to help ensure a smooth patch. So it was probably just a classic embargo breach by an ego wanting to be first, but the leak contained enough for...
Fifth, the fallout: the exact sequencing is still unclear, but with AI's help, hackers managed to reverse-engineer then exploit the original flaw within about six hours (!), collapsing a 'patch-to-exploit' gap that used to be measured in weeks or months.
We're still picking up the pieces, but Cloudflare (one of those internet plumbers) has reported detecting thousands of hack attempts after the initial leak, soaring to millions after PHP's big announcement. Anthropic’s deputy info-security chief is warning things “are going to get a lot worse before they get better” (though a cynic might quip this is like a locksmith warning the neighbourhood is about to face a ton of break-ins).
Either way, that brings us to...
Finally, the response: America's NSA, Australia's ASD, Europe's ENISA, and others have all started sounding the alarm for everyone to update their servers or — failing that — just unplug them!
But two buts (or three if you want to count the one starting this sentence): first, more than half the world's PHP servers run old, unsupported versions that no longer get standard updates. And second, because this flaw can open a backdoor before core systems boot, hackers might escape without leaving the usual web-log traces.
So to translate all that high-nerd dialect into English? We know something massive just happened online. We just don't know — and may never know — exactly what.
Intrigue’s Take
Beyond all the fire-drills and panic-patching, we can’t help but see a pretty sobering list of realisations and implications here, starting with…
| Intrigue Insiders | Membership |
Our experienced, unfiltered takes on what's really going on.
| ✓Daily audio edition | ✓Completely ad-free |
| ✓Insider Telegram community | ✓Monthly AMAs |
| Start your free trial → | $14.99/mo · $149/yr 7 days free |
Intrigue’s Take
Beyond all the fire-drills and panic-patching, we can’t help but see a pretty sobering list of realisations and implications here, starting with…
First, how is it that the internet, arguably our world’s most consequential modern global public good, is still really duct-taped together by a few burnt-out, underpaid coders? The answer lies right there in the question: it’s a global public good, so maybe we’re just re-learning that the same things making the internet so valuable (its openness and decentralisation) also now leave it so vulnerable. We’ve always known about that trade-off, but maybe AI just forces us all to re-evaluate our comfort levels? Speaking of which…
Second, it was AI that found the vulnerability humans missed, and it was humans that then exploited that vulnerability (with AI’s help). So the common thread here is still human. But we don’t seem to hold ourselves to the same standards. Take this example: there’ve been three recorded fatalities involving autonomous cars. Three. Human drivers? We rack up that same US death toll every ~39 minutes! It’s almost like we don’t fear tech because of the actual harm, so much as just the way it turns us into passengers. Maybe we fear the loss of control more than the loss of life? Then…
Third, we also wonder to what extent Silicon Valley and its friends in the White House will now claim vindication from this whole saga. Recall it was only four months ago that those two poles of power really agreed on a kind of sequencing to this emerging tech to ensure good guys get access first. And that same philosophy seemingly worked fine in this instance until someone leaked it. So the immediate lesson might be less about our governing philosophy, and more about our execution around it: whatever PHP’s circle of trust this time around, it was clearly too big.
But then this brings us right back to that first uncomfortable trade-off above: to protect this global public good and the modern civilisation now resting atop it, maybe you need to tighten that circle of trust and squeeze that technical control. But the moment you do that, you put at risk the very openness and decentralisation that made the internet worth building and duct-taping together in the first place.
Sound even smarter:
In adjacent (if not PHP2Shell) news, banks now say they’re scrambling to vet and block third-party AI agents poking around customer accounts.
Today’s briefing is sponsored by:
Stop typing what you could say in 10 seconds.
Wispr Flow turns your voice into clean, professional text inside any app. Emails, Slack, client updates: speak once, send without editing. 4x faster than typing. Works on Mac, Windows, iPhone, and Android.
[👋 Prefer ad-free reading? Sign-up to Intrigue Insiders today!]
Meanwhile, elsewhere…
🇺🇦 UKRAINE — Schrödinger’s link.
President Zelensky has flagged Ukraine’s critical Starlink connectivity still seems throttled, amid President Trump’s latest claim that it’s now up-and-running after he personally got Elon Musk to restore the service. (BBC)
Comment: For those playing at home, in a single week this story has gone from “the White House did it” to “no Elon did it” to “there is no it” to “it’s a private commercial dispute” to now “I fixed it”, the latter then immediately disputed by the democracy actually relying on this tech to swat Putin’s ballistic missiles away from random apartment blocks.
🇳🇱 NETHERLANDS — Wrong number?
Trump envoy/son-in-law Jared Kushner is angrily denying — and threatening legal action — over bombshell claims in Vanity Fair that Dutch intelligence (tracking Russian spooks) found evidence via Kushner’s phone that he was routing hundreds of millions in mysterious payments during Trump 1.0. (Vanity Fair).
Comment: The published book excerpt lays it all out in pretty cinematic detail, while Kushner’s camp denies it all with pretty cinematic force. So somebody is clearly lying, or potentially just getting played? We couldn’t help but notice that the whole saga really hinges on a single (big) tip provided by a Russian spook who supposedly defected to the West in 2017.
🇧🇷 BRAZIL — Neck and neck.
Credible Datafolha polling suggests the left’s President Lula and the right’s Senator Bolsonaro are now tied running into Sunday’s high-stakes election runoff. (Bloomberg $)
Comment: Bolsonaro might have the tiniest of edges, but it’s all still within the margin of error, and you can see that in the fact Brazil’s 10-year government bond yields have actually ticked slightly back *up* this week, after Bolsonaro’s surprise first-round win initially pushed those yields to a two-year *low*. Translation? Traders are now repricing the risk of a more classically tax-and-spend incumbent maybe staying in power.
🇩🇪 GERMANY — Spy central.
Chancellor Merz has confirmed Germany is the target of “intense” espionage after authorities arrested a Ukrainian national on suspicion of passing military secrets (including on tank production and NATO’s eastern flank) to Russia. (DW)
Comment: As a core EU pillar and top Ukraine backer now undergoing a historic rearmament in response to Putin’s aggression, Germany is a natural bullseye for Russian intelligence. As Berlin expands its defence industrial base, it also expands the surface area for Russian approaches, but it all comes amid a series of local spy scandals, including claims that Germany’s former spymaster had been selling secrets to a foreign power.
🇰🇵 NORTH KOREA — Easy does it.
Kim Jong Un’s powerful sister, Kim Yo Jong, is back with her trademark warmth, warning that her family’s hermit kingdom will re-activate anti-South Korea loudspeakers dotted along their shared border in response to what she alleges are the South’s own resumed border broadcasts. (CNN)
Comment: It’s unclear what (if anything) the democratic South has actually done to trigger the North’s latest rhetoric, though any resumption in anti-North broadcasts would likely be a response to the North’s unlawful DMZ mine that injured several of the South’s soldiers last month. It’s all familiar territory, though it always shrinks the broader margin for error along what’s already the world’s most heavily militarised border.
🇲🇾 MALAYSIA — Parting Waze.
Kuala Lumpur has banned civil servants from using the Waze navigation app, citing national security concerns and its roots in Israel (which Malaysia doesn’t recognise). Waze denies it collects sensitive information, and insists it complies “with global legal data protection standards”. (ABC)
🇳🇬 NIGERIA — Ebola reaches West Africa.
Nigerian authorities are urging calm amid word of the country’s first confirmed Ebola case. The broader Ebola outbreak (concentrated in the Congo) is now history’s second-biggest, with a fatality rate near 50%. (RFI)
Comment: This new Nigerian case has now devolved into an inter-state blame game, with the patient insisting she only visited Uganda, which in turn insists she only briefly transited Uganda en route to Central Africa. But now *Switzerland* is weighing in (because the patient is married to a Swiss diplomat), insisting she never visited the DR Congo, in turn contradicting the claims by Uganda. Whatever the precise itinerary, history suggests bureaucratic denial tends to be a lousy epidemiological defence.
Extra Intrigue
Intrigue’s commodities corner is back
Natural gas: Years of under-exploration, declining output, and revised technical figures have seen Bolivia’s certified natural gas reserves plummet by ~50% over the past five years.
Wind: Citing its latest s232 national-security investigation, the White House has initiated new trade negotiations around wind turbines (~78% made in China), which could result in more tariffs.
Sugar: Prices just jumped a monthly 30% in India (the world’s second-largest producer) following erratic weather and related damage caused by disease.
From our sponsors
New Harvard Business Review Analytic Services report: why most AI tools fail at B2B customer service, and what to ask before you invest. Get the free report.
Activity of the day
Pic credit: @andytwelves via X/Twitter
Chivalry isn’t dead, dear Intriguer. It just costs 30p a minute.
At least, that’s how much it cost a few pranksters in East London’s Hackney last weekend, donning full, authentic, medieval armour then straddling neon-green Lime e-bikes, gripping DIY lances, and charging (pedalling?) towards one another at an absolutely terrifying twelve miles per hour.
The resulting impact saw an unholy explosion of steel, capes, chains, and plastic front baskets, which might explain why Sir Buzz Killington over at Lime’s corporate affairs team eventually issued its joyless statement reminding users that their fleet is “designed for getting around the city, not for jousting.” Not with that spirit.
Friday quiz
Odd one out!