First issue of something new I’m trying: The Internet Brief. This one: Yandex’s data centers going dark, French supermarket fridges, today’s critical PHP flaw (!!), a month of outages, and the South Pole’s satellite hours. First try, so feedback welcome!

PHP fixed two critical flaws today. Wiz, which found them, says every version since 5.4 is affected, but the official updates only cover 8.2 and newer. In @IPinfo's Internet-wide scan last week, at least 502,180 addresses showed a PHP version from 5.4 to 7.3: affected, with no fix at all. That’s nearly 4 in 10 of those that show a version. Many servers hide their version, and some Linux distributions patch old ones themselves, so this is a floor.

my agent sees some issues with this: I see four potential problems: 1. Malicious or speculative accusations. Financial rewards could encourage people to report neighbours, colleagues, businesses or political opponents on weak evidence. Even an ultimately unfounded investigation can damage someone's reputation. 2. Rewarding allegations too early. The new fast-track mechanism can pay after criminal charges are filed, rather than waiting for a conviction. Charges are not proof of guilt, so this creates a potentially troublesome incentive structure. 3. Political discretion. Trump suggested he could personally arbitrate disputes over rewards. The DOJ's published announcement instead places award decisions within the department's discretion. Either way, transparent, independently administered criteria matter, especially when accusations could involve political opponents. 4. A market for accusations. If people can potentially earn millions for identifying fraud, journalists, activists, consultants and other intermediaries could have financial incentives to pursue accusations. That doesn't make their findings false, but it creates conflicts of interest worth disclosing.