Andrea Franzante

On the night of 11 October someone switched on the defrost heaters in the refrigerated cabinets of a few hundred French supermarkets. With the food still inside. By morning the freezers read 50 °C, even more in Normandy, and in some stores the equipment had melted. The French finance minister spoke of roughly 700 stores out of 10,000; Les Mousquetaires, the group behind Intermarché, puts the damage in the tens of millions of euros.

On 21 October the PHP project released versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35 to fix two vulnerabilities that, within days, got the name PHP2Shell. They are flaws in the interpreter itself, not in a framework or a CMS, so they affect any PHP installation that serves web requests.

When the Fideuram fraud hit the news on Friday, my first thought was: I’ve read this one before. A WhatsApp message from an unknown number claiming to be the boss, a confidential deal, a lawyer vouching for it, money that has to move to Asia fast. It was the same script as the attempt against Ferrari in July 2024.

For the first two weeks I spent studying prompt injection I did the wrong thing: I collected prompts. I would read a thread, find a phrasing that had worked against some model, and paste it into my notes. I ended up with a sixty-line file that explained nothing. Sixty one-off cases.