Complex systems, wicked problems. Society, technology, science and more. @Princeton professor. @NYTimes columnist. My newsletter @insight https://xitter.cf/t.co/6Ky01N9JwA
floating in a most peculiar way
Joined August 2009
- Tweets12K
- Following740
- Followers379K
- Likes24.1K
Pinned Tweet
My Princeton AI and society team is at the @IASEAIorg AI summit in Paris.
My Neurips keynote for our approach:
slideslive.com/39055698/are-…
Our paper:
ai.sociology.princeton.edu
Say hi especially if you are *utterly* unimpressed by the current doom or hype models.
Wrong nightmares!
This is playing with fire.
Minks and ferrets have such humanlike lung cells that they’re the standard for testing human flu transmission. (Cows aren’t!)
An H5N1 epidemic raging in a mink farm is basically the plot for Dr. Evil tries to spark a pandemic. Luck isn’t a plan.
Here’s something you should know about minks:
They have lungs and airways remarkably similar on a cellular level to those of people.
They’ve spread flus and infected humans before with COVID-19.
Right now, bird flu is spreading on a Utah farm filled with thousands of them… 🧵
ALT A close-up view of a white mink with red eyes and a pink nose baring its teeth and hissing, emerging from under a dark enclosure.
Pandemics chain hard-to-predict events. Luck plays a big role.
But an epidemic in a mink farm is a terrifying petri dish for unleashing the power of evolution towards human-compatible flu viruses. Hard to imagine a worse way to tempt fate.
And for what? Few remaining fur farms.
zeynep tufekci retweeted
New: Sources from three countries confirm that the Trump Administration has advocated Viktor Orbán for UN Secretary-General.
The US has encouraged Orbán to enter the race, even bringing him the initial idea of a joint U.S.-Russia-China candidacy.
WSJ:
wsj.com/opinion/viktor-orban…
zeynep tufekci retweeted
Aleksandar Vucic, Serbia’s longtime nationalist strongman, conceded defeat Sunday in a general election held after his once-tight grip on power was weakened by nearly two years of student-led protests. nyti.ms/4jGxrHn
The first incident has ZERO to do with AI — the cert authority used 4 bit entropy instead of 384 🫠.
In the second, AI is heavily on the defense side of a long-existing problem finally being fixed.
AI creates issues but important to understand them right.
Patch your software.
Two classes extremely bad cyber vulnerabilities disclosed in the last 24 hours. The first potentially impacts everyone online. The second impacts nearly everyone running a server.
tl;dr: Everyone should upgrade their OS and Browser as soon as possible. If you run a server you should upgrade PHP (or ensure it’s removed if you’re not using it) as soon as possible.
The first class of vulnerabilities is a set of root TLS certificates that were discovered to have a trivial private key. Literally the number 4. These roots were controlled by #eMudhra. The problem is that with that an attacker could create a certificate and, if they could get in the traffic flow, intercept traffic to any site or service. The solution is to stop trusting certificates issued by these vulnerable roots. Upgrading your browser and OS is the fastest way for most Internet users to do this.
The second class of vulnerabilities doesn’t apply to most consumers directly, but does apply to most anyone running a server. These vulnerabilities have been dubbed #php2shell. PHP is one of the most widely used web programming languages. It’s estimated 70% of websites run on PHP. These vulnerabilities allow an attacker to send a crafted set of queries to a server running PHP and potentially take over the server. From there they could potentially read, modify, delete, or repurpose anything on the server. The solution is to upgrade PHP to the latest version ASAP. Even if you’re not using PHP for your web development, it’s often included by default. So make sure it is either upgraded or fully removed.
@Cloudflare received advanced warning of both of these classes of vulnerabilities. We’ve ensured that where we act as a proxy we are no longer trusting the vulnerable roots. We are also reviewing certificate transparency (CT) logs for any sign the vulnerability was exploited before its disclosure. We have not found any evidence but CT logs are not perfect and a sophisticated attacker who knew about the weakness could have exploited it without a new certificate being logged.
For the PHP vulnerabilities, we have deployed mitigations available for all customers for free. Because of the complexity of the vulnerabilities and number of ways it can be exploited, we also released new WAF capabilities that are unique in the industry to catch the exploit based on the response. These too are available for every Cloudflare customer for free.
Even if you are taking advantage of Cloudflare’s protection, it is important to upgrade your OS, browsers, and PHP installations as soon as possible. We can provide a strong bandaid, but the best protection is to fix the underlying problem.
If you’re interested in learning more, you can read our blogs:
Vulnerable roots: blog.cloudflare.com/emudhra-…
PHP vulnerabilities: blog.cloudflare.com/php-vuln…
Above post but in substantive form.
This was bound to happen, AI is helping us fix things now, which is great, but the legacy code is not safe. Maybe we will finally contemplate moving forward.
Today's PHP apocalypse is akin to an overdue forest fire for the legacy World Wide Web, that long tail of at least 40M+ websites running PHP. It's the end of an era: the carnage kicking off now plays into a larger ongoing trend for the decline of the human-readable web over the coming years
Realistically, despite anyone's best efforts, some uncountably large number of sites are not going to be saved by fire brigades today. These sites are naked and vulnerable and being compromised as we speak. There is no happy ending, only mayhem.
This day was always coming. As long ago as 15 years ago, I was warning friends to pick another tech stack for their blogs and their websites, and I'm sure I wasn't alone in doing so. On my part, I felt that the quality of the PHP engine and runtime was a ticking time bomb, and that's only become more evident ever since
That bomb has gone off a number of times since, including as critical remote code execution incidents in 2012, 2019, 2024, and now. In total, PHP has amassed some 750+ CVE reports to its name and counting. And as might be expected, the pace of CVEs has picked up this year compared to recent years
This crisis is unlikely to be contained. You don't need Mythos access to find problems in the PHP runtime, just point Fable or Astra at it. What we are witnessing is growing strong selection pressure against large hairy legacy code bases in C/C++
Nothing better sells Rust's memory safety and ownership constraints than trying to do without them in a code base like PHP's--at some point even the clanker will begin suggesting that "you know, if I might just rewrite this wee little bit in Rust..."
Meanwhile, numerous personal blogs and other cobbler's-children kind of projects are, no doubt, in the process of getting a long overdue migration to static site generators. And another bunch is getting purged off the net altogether, as the easiest and most economical response to getting hacked. Thank goodness for the Wayback Machine!
I suspect there’s a long-tail of unpatched, barely-maintained PHP sites that are now sitting ducks but…
As far as I can tell, there is not yet any major actual exploit of the PHP bug that AI helped discover so we can fix it? Anyone?
(Note: many people worked hard for this!)
We protect over 5 million PHP sites and when we find a major exploitable vulnerability, we always see site cleanings. We have seen exactly zero hacked sites from php2shell. Zero. Across a population of 5 million PHP sites that our product protects. Draw your own conclusions. #php2shell
zeynep tufekci retweeted
SCOOP: The State Dept has started asking career diplomats up for promotion if they voted for Trump in 16, 20, 24.
Federal law prohibits politically based hiring for career staff.
State tells @washingtonsun it's screening for "fidelity" and execution of the president's vision👇
zeynep tufekci retweeted
NEW: Trump’s mega Venezuelan oil deal, signed by Hegseth and Rubio, benefits an unknown group of investors and was intentionally crafted to keep the next U.S. president or future leaders of Venezuela from undoing it. @propublica saw the secret contract: propublica.org/article/trump…
zeynep tufekci retweeted
SCOOP: Julio Herrera Velutini, a Venezuelan billionaire, really wanted a pardon. He got it not long after his daughter hired Alina Habba, a lawyer close to Trump, in a deal worth more than $50 million. Habba was also working at DOJ at the time.
nytimes.com/2026/10/20/us/po…
zeynep tufekci retweeted
NEW @citizenlab report We uncovered an Israeli firm using online ads to run vast spy operation
This is the first-ever public confirmation of zero-click mercenary spyware delivered via targeted ads.
45 devices at @AJEnglish confirmed infected
citizenlab.ca/research/how-d…
zeynep tufekci retweeted
"So this is the phenomenon we’re dealing with: you have businessmen selling a technology, a Nobel Prize winner operating in the realm of science fiction, and this 26-year-old [Jacob Coxon] telling you: 'I’m on the inside, and I can see it.' Then, of course, you can say that journalists bear some responsibility, and that’s partly true, but it’s only natural: how can you not write an article about it when all the other journalists are doing so?"
This full interview of Michael Jordan is well worth reading. The other MJ occupies the same position in basketball roughly as this one in machine learning
di.ens.fr/~fbach/MJordan_ITW…