Two critical vulnerabilities in PHP, the language that powers around 70% of websites, came to light on a Tuesday in October after being discovered by researchers using a frontier model from OpenAI. If exploited, they allowed attackers to take complete control of servers, copy their contents or bring websites down; websites belonging to public authorities in Switzerland, Germany and Finland were proactively taken offline.
Charlie Warzel tells the story of Ondřej Surý, a Czech volunteer who does not work for the PHP Foundation and whose actual job is leading DNS development at the Internet Systems Consortium.
In his spare time, funded by donations, he compiles the packages that allow thousands of servers to be patched with a single command, even those running the obsolete version 7.4. The not-so-obvious part: AI has drastically reduced the cost of finding vulnerabilities, but fixing them still depends on a volunteer and his homemade automation. If attacks scale at machine speed, the infrastructure of half the internet continues to be patched at the pace of one person who lives on donations.
Naturally, the Spanish public administration was caught with its pants down. The joy of seeing the citizens’ portal where you receive all those lovely little official notifications out of action for a couple of days: the famous DEHú.
You’re reading ZERO PARTY DATA. The newsletter on current affairs and technology law by Jorge García Herrero and Darío López Rincón.
In the spare time this newsletter leaves us, we sort out complicated issues involving personal data protection and artificial intelligence regulations. If you’ve got one of those, give us a little wave. Or contact us by email at jgh(at)jorgegarciaherrero.com
🗞️News of the Data world🌍
.- Hidden in the €17 billion settlement that Meta signed with 52 states and territories over harm to minors was a little word repeated 45 times: “Cambridge.” Jason Kint uncovered a settlement within the settlement: $459,293,017.80 (those eighty cents are an endearing detail) to settle state claims over Cambridge Analytica, distributed in an annex among 46 states and two territories. The Washington D.C. case and the New Mexico trial were excluded (and the latter has already cost $25 billion). The juicy bit: the waiver expressly covers facts of which the states are unaware “for any reason,” including negligence… We'll see.
.- The Premier League (and the Spanish league) has found its latest marginal gain in the most unexpected place: the urinal. According to The Athletic, Arsenal, Manchester City, Manchester United, Aston Villa and Ipswich Town have installed Kamleon’s S-Urinals at their training facilities. Here’s how it works: the player selects anonymous mode or their profile on a touchscreen; sensors measure specific gravity, colour, volume and electrolytes in seconds and return a traffic-light score out of one hundred, which is also sent to the medical staff. Necessary? A 2020 review found that 66.2% of the professionals assessed were dehydrated or underhydrated, and hydration changes too quickly to wait for laboratory results. It has even been used to support players fasting during Ramadan.
The inevitable legal observation. The whole business of publishing professional athletes’ health data in real time is getting, ahem, out of hand: every identified urination constitutes health data under Article 9 of the GDPR collected by the employer, and monitoring fasting may also reveal religious beliefs. The “choice” of anonymous mode doesn’t provide much anonymity from the coaching staff.
.- Bitchat, Jack Dorsey’s messaging app (remember, the Twitter guy), has climbed to number one among social networking apps in the French App Store. Kyle Torpey identifies the perfect storm: October 17 protests over the cost of living, involving looting and more than 1,800 arrests; former Prime Minister Gabriel Attal’s proposal for temporary, selective social media shutdowns in areas affected by unrest; and an almost ten-hour outage of Orange’s mobile network.
Dorsey’s app works over Bluetooth mesh networks without internet, accounts or phone numbers, making use of nearby devices belonging to other people. It encrypts private messages using the Noise Protocol and reaches around 300 metres through hops; when connected to the internet, it uses Nostr.
Minister Laurent Nuñez acknowledges that suspending platforms is possible, subject to the conditions set by the Conseil d’État, which already struck down the TikTok ban in New Caledonia as disproportionate. The little detail: merely debating whether to shut down networks is enough to trigger a surge in precautionary downloads of these things. And the public #mesh channel, readable by anyone nearby, turns the anti-censorship tool into an open noticeboard for anyone wishing to monitor the protests.sta.
.- A WhatsApp channel called “Lula’s Army” is taking much of the credit — always according to its members — for Lula da Silva’s comeback against Flávio Bolsonaro in just three weeks. Led by congressman André Janones, the channel reached 10.8 million followers by distributing ready-to-share templates, each with a specific “mission”: make the latest video go viral, get a hashtag trending, don’t go to sleep without completing the task.
There was even a 24-hour livestream on the eve of the election, and Lula called Janones “our General.” To nobody’s great surprise, political scientists Denilde Holzhacker and Mayra Goulart pour cold water on the enthusiasm: it’s impossible to measure how many votes can be attributed to the channel, and the key was combining digital activity with grassroots mobilisation to reduce abstention. What sticks with me is that the Brazilian left seems to have won by adopting exactly the WhatsApp network tactics it had been criticising Bolsonaro’s movement for since 2018. A bit like what Trump did, picking up Obama’s favourite tool. And the re-elected Lula promises that digital communication will play a much bigger role in his government.
.- Noyb, together with three other organisations, has filed 5 complaints in France, Italy, the Netherlands and Austria against Scale.AI. A tiny little American company that, through its OUTLIER AI platform, provides AI training services (prompts, answering questions) to the industry’s big players. The thing is, behind it are 900,000 workers who are more like freelancers under Blade Runner-style surveillance. Full profiling on their personal devices and mandatory biometric identification. We’ll see how it ends, but it’s almost reminiscent of those Chinese cushions designed to detect unauthorised or excessively long toilet breaks.
📖 Hard data documents for coffee lovers ☕️
.- The EU Council has agreed on its mandate for the Digital Omnibus, the “data” part of the simplification package whose AI section was already approved on June 29. Takeaways: the text amends the GDPR, updates the cookie rules under the ePrivacy Directive, repeals parts of the P2B Regulation and consolidates the body of data legislation. A surprise for the purists: the current definition of personal data is preserved, exactly what the EDPB and EDPS pleaded for in their joint February opinion, and the rules on cookies and tracking remain in place. In exchange, the text — phew! — “clarifies” pseudonymisation, supports exemptions for scientific research, introduces safeguards for processing sensitive data in biometric verification and AI system development, and extends the deadline for reporting breaches.
💀Death by Meme🤣
🤖Robots.txt or the AI Stuff
.- The educational videos made with Claude by Andrés Guadamuz are off the charts.
.- The Spanish Data Protection Agency (AEPD) has just published an easy-to-follow list of ten rules to help everyone exercise caution when using AI agents. It doesn’t say anything new, but it does hit the mark on many of those configuration options and preventive measures that people tend to forget:
Be careful about leaving the memory option enabled, so the AI doesn’t connect everything you upload and build a wildly intrusive profile of you.
Don’t upload anything containing data you shouldn’t share.
Give it the minimum access necessary for what it needs to do.
Choose the best option for privacy, one that guarantees the information doesn’t leave the device. The need for a warning from the relevant regulatory and supervisory authority is understandable, but meeting that requirement is difficult.
And remember that “delegating does not mean washing your hands of responsibility.” You know the drill about decisive human oversight, and then, when you fail to review the document, the client tells you that the properties of the Word file you sent say “made by Claudio.”
📃The paper of the week
.- Privacy Preference Controls for Agentic Systems by the authors: Shreya Kochar, Peeranat Sugsavanvit, Vidur Gupta, Joseph A. Calandrino, Deepak Kumar, Brett Frischmann, Sebastian Zimmeck. By analysing which privacy controls or options would be most appropriate to implement in AI, they produce an overview of how the major providers comply with the options they have already implemented (or should have implemented). To nobody's surprise, the ability to opt out of AI training is rather hit-and-miss.
🙄 Da-Tadum-bass
It’s not the first free browser game for relieving stress by destroying whichever webpage you choose, but it is one of the more polished ones: Destroy any website. And it pays tribute to the legendary “stickman fights” from an earlier, simpler era of the internet (for example, Animator vs Animation).
It won’t be long before that magical moment when your know-it-all brother-in-law starts asking for confidential information, special-category data and worse.
If you're missing a document, comment or piece of nonsense that quite clearly should have appeared in this week's Zero Party Data, write to us or leave a comment and we'll consider it for next time.