flaw

In the most complimentary way, I ask: What the heck was that first half, UCLA?

Yes, really. With Saturday’s 28-10 victory over Michigan State, Bob Chesney has the Bruins football team 7-0 for the first time since 2005. Still undefeated and still the only team in the Big Ten — and SEC — conferences that can say so. Ranked No. 9 in the nation and moving on up.

And so I ask: Two lost fumbles before halftime? Two drops? Two holding penalties? A meager 84 yards through the air and a modest 14-7 halftime lead? Against a majorly depleted Michigan State team fielding a freshman third-stringer at quarterback — that also lost two more of its best players to injury in the first half?

These Bruins are too good to be letting the wounded Spartans (2-6, 0-5 Big Ten) hang with them for even a half.

And yet, for a hot moment, doubt started to creep back in: Was this the day Chesney’s chariot turned back into a pumpkin? Was the last petal from the enchanted rose about to fall, this beauty of a season due to turn ugly? Was the fairy tale almost over?

No. The nation’s best second-half team gathered itself — “at halftime in the locker room, guys coming over, ‘Let’s go, man. We got you!” quarterback Ty Dieffenbach said — exerted its will and outscored the Spartans 14-0 in the third quarter. They mercifully ran out the clock with a commanding 28-7 lead going into the fourth and improved to a tidy 5-0 in the Big Ten.

It’s what Chesney’s teams do.

Last season at James Madison, the Dukes led the nation in second-half scoring, averaging 20.9 points per game.

And this charmed season at UCLA, the Bruins came into Saturday’s game averaging the second-most second-half points in the nation (20.8).

Being able to bear down and wear down opponents is a sign of a good team.

Being able to jump on them at the outset would be the sign of a great one.

Let’s fast-forward a year. You’ve stopped pinching yourself to make sure you aren’t dreaming and the Bruins — who were unranked and unheralded to start the season after so many years of ineptitude — really are in control of their own College Football Playoff destiny.

UCLA linebacker Donavyn Pellot celebrates with linebacker Sammy Omosigho, left, after a 67-yard interception return against Michigan State on Saturday.

(Allen J. Schaben / Los Angeles Times)

A year from now, you’ll have been conditioned to expect them to win these games, and you’ll no longer be worried about whether this was all a dream.

But you would be concerned about slow starts. You’d bemoan sluggish opening acts and fret about how that might bite the Bruins in the big games that are looming.

Chesney doesn’t have to make that imaginative leap into the future.

He’s worried about it now. And that’s why his Bruins are legitimately a team to contend with, because he’s coaching them to be that. He expects it: “When you walk on that field on Saturday, you walk out and know that you’ve done it the right way, and that’s how you treat something that’s important. Not special, but important.”

And so I ask: Why didn’t UCLA treat the first half like it was important Saturday?

“Two fumbles, two drops, two holding penalties? You can’t do it, you just can’t do it if you want to win really close games,” said Chesney, the first-year UCLA coach, who said he’d spend the week before the Bruins host Nevada in a nonconference Halloween game by emphasizing ball security at practice and that he’d watch the tape to determine what triggered the holding penalties.

“We’re taking three, four touchdowns off the board by doing that,” Chesney added. “Never going to let this happen again.”

UCLA can’t because it doesn’t have any room for error.

UCLA coach Bob Chesney works with players before a 28-10 win over Michigan State at the Rose Bowl on Saturday.

(Allen J. Schaben / Los Angeles Times)

If the Bruins win out, Chesney will have directed an underdog to a surprise CFP berth for the second consecutive season. But if the Bruins lose a game, it gets dicey.

Never mind the rows of recruits at Saturday’s victory, and forget for a moment about the fans who are slowly finding their way back to the Rose Bowl for Bruins football games. UCLA needs to continue to impress the computers and the pollsters and CFP committee members who could eventually determine UCLA’s fate if the Bruins don’t do it themselves.

And though no fault of Chesney’s, UCLA is playing a soft schedule. Per ESPN, the Bruins’ slate was the 51st easiest coming into the season and what remains of it is the 64th easiest.

And UCLA, which is winning behind a backup quarterback, which went 3-9 last season and which had so much ground to cover after starting the season outside of the top 25 — won’t likely get anyone’s benefit of the doubt if a first-half lull leads to a loss.

The Bruins are proving themselves probably the best team in the nation after halftime.

If they can do that, why not aim to be the best team in the nation?

Fours (quarters) up!?

Government websites in Europe and elsewhere have gone offline after news of critical vulnerabilities in a widely used programming language sent website operators scrambling to protect their systems.

Developers of the PHP programming language on Wednesday released urgent new fixes, saying all users were “encouraged to update immediately”.

PHP runs on the servers that host websites, building pages behind the scenes before they reach a visitor’s browser. Most people never see it, but it powers everything from blogs to online shops and government portals.

The vulnerabilities, which had been lurking in the software for years, were uncovered with the help of artificial intelligence. Details about them leaked online on Tuesday before fixes were available, forcing PHP to rush them out.

Experts said they were bracing for a wave of intrusions as hackers jumped to get ahead of the updates.

What is the bug?

Andrew Cullen, a lecturer on AI and cybersecurity at the University of Melbourne, said many devices in the world are connected to one piece of foundational software, which is where the bug was found.

The vulnerability allows a hacker to run code on a website, meaning they could change the website or force it to release personal information collected in a database, Cullen told Al Jazeera.

Both flaws stem from how PHP handles fatal errors, such as running out of memory. Because the problem sits in PHP itself, even the simplest website running an affected version can be vulnerable, and attackers could read passwords and other credentials from a server’s memory, the cloud security company Wiz said. Both flaws scored 9.2 out of 10 on the industry’s standard severity scale, placing them in the “critical” category.

The two flaws, nicknamed PHP2Shell, were found independently by two cybersecurity companies using AI. Calif, working with OpenAI, reported the first on August 11. Wiz, which is owned by Google, reported the second on August 24.

The vulnerabilities remained hidden in the PHP codebase for more than a decade and would have been extraordinarily complicated for a human hacker to take advantage of, Wiz said in a statement.

Calif and Wiz said they had coordinated with each other, the PHP team and OpenAI before making the vulnerabilities public.

However, Amazon security chief CJ Moses said his security team detected an attempt to exploit the vulnerabilities on October 17, four days before the public disclosure.

Moses said it was unclear how the hacker learned of the flaws while Calif’s and Wiz’s reports were still under embargo. Security researchers usually keep details of flaws secret until a fix is ready, so attackers cannot use them in the meantime.

Who can potentially be affected?

PHP, a language that dates back to the early 1990s and initially stood for Personal Home Page, underpins huge parts of the public-facing web and is baked into WordPress, Drupal, Joomla and Magento sites, meaning any critical vulnerability potentially has enormous knock-on consequences.

Calif, Wiz and the web infrastructure company Cloudflare said the flaws affect PHP 5.4 and later versions, more than a decade of releases.

Cullen said the vulnerability was “really unprecedented”, noting that PHP powers more than 70 percent of websites globally, although sites that have been updated are protected.

“There is a real risk to the kind of shared digital infrastructure that we all rely on,” Cullen told Al Jazeera. “There is concern in the cybersecurity community about what the blast radius for this will be, even though the developers of PHP have been very quick to try and develop patches for it.”

Cullen added that while AI was getting better at cybersecurity, it was also getting better at being a hacker. “This means that we are developing systems … that are making the internet safer by helping to fix bugs, but we’re also making it riskier by discovering bugs and creating bugs they’ll be able to hack,” he said.

What has the impact been so far?

In the Netherlands, the Dutch cybersecurity agency itself went offline, saying it had done so as a precaution because of the vulnerabilities. Several organisations followed the example and took public-facing websites offline, including the Port of Rotterdam, government portal Overheid.nl, the national football association KNVB, the websites for the country’s five largest political parties and several hospital ‌websites.

Dutch Prime Minister Rob Jetten said he was closely monitoring the situation.

Disruptions were even more widespread in Finland, where state IT services provider Valtori said government public network services had been taken offline “as a precautionary measure”.

France’s Ministry of the Interior said it had placed all of its websites into preventive maintenance.

Belgium’s Federal Public Service Foreign Affairs, Foreign Trade and Development Cooperation said it had temporarily taken its websites offline after reports of cyberattacks exploiting the PHP vulnerabilities although the country’s cybersecurity centre said it had not recorded any attacks on Belgian websites.

South Korea’s ⁠government raised ⁠its private-sector cybersecurity alert level and activated emergency response measures. It issued security guidance to about 28,000 companies with registered chief information security officers and 5,900 members ⁠of a government information-sharing ⁠network as well as operators of critical infrastructure, web-hosting firms and data centres.

The operator of the online encyclopedia Wikipedia also said it had taken down an unspecified number of systems until they could be safely patched while the Internet Archive, the sprawling online library, said it also briefly went offline to deal with the issue.