Opens in a new tab

Breaking news

Is Europe Ready To Defend Itself? Five Signals From A Defining Defence Summit

Europe’s security debate is no longer theoretical. With Russia’s war in Ukraine grinding on, hybrid attacks intensifying and defence budgets under pressure, the question now confronting policymakers is blunt: is the continent prepared to defend itself?

That was the central issue at the Euronews Defence and Space Summit, where lawmakers, officials and industry leaders gathered to confront a strategic reality that has shifted sharply since Russia’s full-scale invasion of Ukraine. The war has exposed structural gaps in Europe’s military readiness, industrial capacity and long-term deterrence posture.

What emerged from the summit was not consensus, but urgency. From warnings over nuclear escalation to renewed arguments about procurement and industrial sovereignty, the message was clear: Europe can no longer afford to move slowly.

Radev Raises The Alarm

Bulgarian Prime Minister Rumen Radev was one of the summit’s most closely watched speakers, and he used the platform to challenge the EU’s approach to backing Ukraine. He argued that the strategy amounted to a failed attempt at “peace by force.”

“The war in Ukraine challenged our critical thinking and realistic approach,” he said. “It challenged our ability to assess the strategic centre of gravity of the opponent. It challenged most of all our ability to design feasible political objectives and to translate them into a sound military strategy and to define a desired end state.”

Radev called for deeper diplomatic engagement with Moscow, warning of what he described as the worst-case scenario: a nuclear attack on Europe. Russia, which holds the world’s largest nuclear arsenal, continues to cast that shadow over every discussion of escalation.

His remarks came just hours after Reuters reported that Moscow had sent a document threatening to use “the entire arsenal of forces and capabilities at its disposal, including nuclear weapons” to defend its territory.

Rutte Reassures Allies

NATO Secretary General Mark Rutte responded with a markedly different tone. His message to Moscow was direct: stop the nuclear threats.

Rutte declined to comment on the reported Russian document, but he dismissed the broader intimidation campaign as bluster rather than a credible NATO threat. “Putin knows he can never win against NATO, so I don’t take this seriously,” he said. “Of course, we had to reply and make clear to him that NATO is a defensive alliance.”

He also addressed the surge in hybrid attacks against allied states, including an arson attack at a robotics defence company in Estonia and a reported attempted drone attack at Leipzig airport in Germany. In Rutte’s view, these incidents are designed to distract from battlefield setbacks, fracture Western unity and weaken support for Kyiv.

“There is no immediate threat to NATO territory,” he said, while stressing that the alliance would defend “every inch” of its territory. Rutte also praised Ukraine’s battlefield gains and deep strikes into Russia, but underscored a persistent vulnerability: air defence. Continued deliveries of Patriot interceptors, he said, remain essential.

Francken Warns Of A Dark Winter

While some leaders sought to project calm, Belgian Defence Minister Theo Francken struck a more alarmed note. He warned that Europe was entering a “dark winter” marked by escalating interference and pressure from Moscow.

“Russia, air attack, air attack, air attack. This is the biggest threat. So we need air defence, air defence, air defence,” Francken said. “We need to have more stocks, more production, scale up production, and a large industrial base. Everything has to go faster.”

His remarks reflected a growing recognition across Europe that modern warfare is evolving quickly, particularly in drones, electronic warfare and air defence. Francken argued that Europe must learn faster from Ukraine’s frontline experience to avoid building stockpiles that become obsolete before they can be deployed.

He also acknowledged Belgium’s own history of underinvestment. “We were like the worst pupil of the NATO class,” he said, noting that defence spending had doubled but warning that years of neglect cannot be repaired overnight.

The Fight Over Made In Europe

The summit also exposed an increasingly political argument over defence procurement and industrial policy. Europe’s security remains closely tied to the United States, NATO’s dominant military power, but transatlantic tensions have deepened as Washington pushes European allies to take on more responsibility.

Matthew Whitaker, the US ambassador to NATO, sought to reassure European governments that the United States remains committed to the alliance. “We’re not stepping back. We’re just asking our allies to step forward and join us,” he said.

Andrew Puzder, the US ambassador to the EU, took a more combative line, criticising the bloc’s push for “Made in Europe” preferences in public procurement, including defence contracts. The idea, rooted in French policy thinking and increasingly supported in other capitals, aims to strengthen European industry and reduce dependence on external suppliers.

Puzder argued that capability should outweigh geography. “When lives are on the line, capability and availability should determine the solution, not geography,” he said. He instead promoted a “Made in NATO” approach that would give US defence firms broader access to European procurement.

Europe’s Defence Test Is Here

The summit made one point impossible to ignore: Europe’s security challenge is no longer abstract. It is financial, industrial, technological and strategic all at once. Governments must decide whether to accelerate investment, deepen coordination and accept the political cost of rearmament, or risk remaining dependent on others in a more dangerous world.

As the war in Ukraine drags on and the threat environment grows more complex, Europe’s ability to defend itself will be measured not by declarations, but by speed, scale and sustained political will.

AI Finds Two Critical PHP Security Flaws, Prompting Urgent Website Shutdowns Across Europe

Artificial intelligence has helped expose two serious security flaws in PHP, the programming language powering much of the internet, prompting organisations across Europe to take websites and digital services offline while they worked to prevent potential attacks.

The vulnerabilities had remained undetected for more than a decade. Advanced AI systems from OpenAI and Google helped turn a suspected weakness into a working exploit, highlighting how quickly AI could accelerate cyber threats.

Europe Moves To Contain The Risk

The Netherlands took down its DigiD digital identity system, the Overheid.nl government portal and the website of the lower house of parliament. The Port of Rotterdam, hospitals, the country’s five largest political parties and even the Dutch National Cyber Security Centre also took websites offline.

Elsewhere, Finland’s state IT provider Valtori suspended government web services, France’s Interior Ministry placed local administration websites into maintenance mode, and Germany’s federal IT service, ITZBund, took several portals offline.

CERT-EU advised organisations unable to patch immediately to take affected websites offline. The European Commission, ENISA, CERT-EU, Europol and national cyber response teams subsequently urged organisations to act without delay, particularly on internet-facing systems.

Why PHP Matters So Much

Created in the early 1990s, PHP remains one of the web’s most widely used programming languages. Security firm Wiz Research estimates that it runs behind roughly seven in 10 websites, including platforms such as WordPress, Drupal and Joomla.

PHP handles essential functions such as logins, payment processing and content delivery, making vulnerabilities in its code a potential global risk. According to Wiz, every PHP version released over the past decade is affected by at least one of the flaws.

A fix was released on Wednesday. The PHP Foundation urged teams to update immediately to patched versions PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35. Older versions no longer receive official support and should be considered exposed unless vendors have backported the fix, CERT-EU warned.

Websites and applications, from the Paris police website to a Pokémon sleep tracker, temporarily went offline as developers secured their systems.

How AI Turned A Theory Into A Working Attack

The vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619 and rated 9.2 out of 10 in severity, affect PHP’s memory management and error handling. Under specific conditions, an attacker could exploit a memory-limit issue to execute malicious code remotely without logging in.

The PHP Foundation said developers first identified signs of the problem during an external audit in 2024. Although researchers developed a theoretical exploit, progress towards a practical attack path and a fix repeatedly stalled as the small core team weighed the risks. The foundation later called the delay “a structural failure”.

In August, security firm Calif, working on an OpenAI-funded audit of PHP’s source code and using OpenAI’s GPT-5.6 Sol model, reported a working remote attack. OpenAI independently identified the issue that day. Two weeks later, Wiz developed additional attack paths using its Wiz Atlas tool alongside Google’s Gemini 4 Argon and GPT-5.6 Sol.

“With frontier AI models and the right tools, a single researcher completed in a week what previously would have taken a world-class team months of work,” Wiz researchers wrote.

OpenAI called the discovery “one of the most impactful vulnerabilities in recent memory”, saying AI could now identify security flaws with “internet-scale impact”.

The findings were kept confidential while a fix was prepared. However, the two CVE identifiers appeared on online forums and social media on Tuesday afternoon. PHP brought forward its release by a day, while Calif mistakenly published and then deleted a video demonstrating its proof of concept against multiple targets. Copies quickly spread, according to the PHP Foundation.

“The moment all the information’s out there, people can weaponise it very, very quickly,” Steve Kerrison, a senior lecturer in cybersecurity at the Singapore campus of James Cook University, told AFP.

Has Anyone Been Hacked Yet?

Taking a website offline does not necessarily mean it has been compromised. Dimitrios Salampasis of Australia’s Swinburne University of Technology said shutdowns can be a responsible precaution while patches are applied.

The PHP Foundation said its security team reviewed the proof-of-concept code circulating after the leak and found no functional exploit at the time of release.

However, Cloudflare reported attack traffic targeting its customers on Wednesday, while CERT-EU warned that the public availability of technical details could encourage attackers to probe vulnerable systems.

Large organisations may patch quickly, but smaller operators could remain exposed for weeks or months. Personal blogs and small business websites could be hijacked to distribute malware, send spam or host malicious content.

The Bigger Risk Goes Beyond The Patch

Even after systems are updated, stolen data could be used in phishing attacks to obtain passwords, payment details and other sensitive information.

Third-party dependencies add another risk: websites may remain exposed if the providers they rely on fail to patch their own systems. “Even though you patched yourself … you’re still unsecure,” said Rahat Masood, a senior lecturer in cybersecurity at the University of New South Wales in Sydney.

The incident also raises questions about the resources behind PHP’s security. The language supports government services, banks and online retailers worldwide, yet its security depends heavily on a relatively small group of foundation-funded developers and volunteers.

AI can identify and demonstrate vulnerabilities faster than ever, but fixing them without disrupting the systems that depend on them still requires experienced engineers and a more resilient approach to software security.

Aretilaw firm
The Future Forbes Realty Global Properties
eCredo
Uol

Become a Speaker

Become a Speaker

Become a Partner

Subscribe for our weekly newsletter