Parents in France are underestimating how frequently their children use artificial intelligence, while many say they lack the support needed to guide them towards responsible use, according to a new YouGov survey commissioned by Berlin-based non-governmental organisation Interface.

The survey found that 40% of children aged 11 to 12 use general-purpose AI services, such as ChatGPT, every week. However, only 26% of their parents were aware of this use, a gap of 14 percentage points.

The research, conducted online between June 24 and 30, included 1,138 parents of children aged 11 to 17 and 970 children in the same age group. It examined the use of several AI technologies, including chatbots, digital companions, voice assistants and AI features built into social media platforms.

The findings suggest that AI tools are becoming part of children’s lives at an early age. Among respondents aged 11 to 12, 56% said they used at least one type of generative AI tool weekly. General-purpose AI services were used by 40%, while 33% reported using voice assistants. Another 23% used AI features embedded in social media, and 16% said they interacted with AI companions.

Jessica Galissaire, a senior policy researcher at Interface, said AI chatbots could function like always-available companions because they do not tire and may consistently agree with users. She also raised concerns about younger children accessing services whose age requirements they do not meet. Character.AI, for example, requires users in the European Union to be at least 16 years old.

The survey found that parents consistently underestimated AI use across age groups. Among children aged 13 to 15, 62% reported regular use, compared with their parents’ estimate of 52%. For teenagers aged 16 to 17, the figures were 70% and 61%, respectively.

Time spent using these services was another concern. According to Galissaire, 92% of generative AI users said they spent more time on the technology than they intended. AI companions and AI features integrated into social media recorded particularly high levels of unwanted extended use, at 59% and 57%, respectively.

Parents also reported limited support in helping their children navigate AI. Only 32% felt sufficiently supported, while 26% said they received some support but not enough. The remaining 42% said they received no support at all.

When asked who should help protect and educate children about AI, 51% of parents identified teachers and schools, while 41% pointed to technology platforms and 30% to public authorities.

The findings come as the European Union considers its proposed Kids Act, which aims to strengthen platform accountability through measures including age limits, parental controls and restrictions on features considered addictive.

Galissaire argued that regulation alone would not address the risks. She favoured requiring platforms to be safe by design, alongside prevention and education, warning that age restrictions could create a false sense of security if parents stopped monitoring their children’s online activities.

Artificial intelligence helped uncover two critical security vulnerabilities in PHP, a programming language used by about 70 per cent of websites worldwide, prompting government agencies, businesses and online platforms to take services offline while installing emergency fixes.

The flaws had remained undetected for more than a decade and could allow attackers to execute malicious code on vulnerable servers without logging in. The discovery triggered precautionary shutdowns across Europe, affecting services ranging from the Netherlands’ digital identity system and parliament website to government portals, hospitals and commercial platforms.

The Netherlands temporarily took its DigiD digital identity service, the Overheid.nl government portal and the lower house of parliament’s website offline. Finland’s state IT provider, Valtori, suspended government web services, while France and Germany also restricted access to several public websites.

CERT-EU, the cybersecurity service for European Union institutions, advised organisations unable to apply the fixes immediately to take affected websites offline. European institutions and national cyber response teams jointly urged operators to prioritise internet-facing systems.

PHP, originally named Personal Home Page, handles behind-the-scenes website functions such as processing payments, checking user logins and delivering content. It underpins widely used platforms including WordPress, Drupal and Joomla, making vulnerabilities in the language a potential threat to millions of online services.

The PHP Foundation released security updates on Wednesday and urged administrators to upgrade immediately. Patched versions include PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Older versions no longer receiving official updates should be considered vulnerable unless suppliers have applied the fixes separately.

The vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619, received severity ratings of 9.2 out of 10. They affect areas involving memory management and error handling, potentially enabling remote code execution under specific conditions.

The PHP Foundation said developers had identified early signs of the problem during an external audit in 2024, but efforts to develop a practical exploit and determine an appropriate fix stalled for months. It described the delay as “a structural failure”.

Artificial intelligence subsequently helped researchers establish working attack methods. Security firm Calif identified a functional remote attack in August during an OpenAI-funded audit using OpenAI’s GPT-5.6 Sol model. OpenAI independently identified the same issue, while Wiz later found additional attack methods using its Wiz Atlas tool, Google’s Gemini 4 Argon and GPT-5.6 Sol.

Wiz researchers said one researcher had completed in a week work that might previously have required a specialist team months to accomplish. OpenAI described the findings as “one of the most impactful vulnerabilities in recent memory”.

The vulnerabilities were initially disclosed privately while developers prepared a patch. However, the identifiers leaked online on Tuesday, prompting PHP to bring forward the release. Technical details and proof-of-concept material subsequently circulated, increasing fears that attackers could quickly develop working exploits.

Security experts stressed that taking websites offline did not necessarily mean they had been compromised. The PHP Foundation said its security team found no functional exploit in the proof-of-concept material circulating when the patch was released.

However, Cloudflare reported observing attack traffic targeting its customers on Wednesday, while CERT-EU warned that public disclosure increased the likelihood of active probing.

Experts warned that smaller businesses and independently operated websites could remain exposed for weeks or months if their administrators failed to apply updates. Even organisations that patch their own systems may face risks from third-party services that remain vulnerable.

The incident has also renewed calls for stronger investment in software security. The PHP Foundation relies on a relatively small group of funded developers and volunteers to maintain technology used by governments, banks and online retailers worldwide. Researchers say AI can accelerate vulnerability discovery, but experienced engineers remain essential to developing safe fixes and protecting interconnected systems.

Uber is preparing to expand its driverless taxi services across Europe after launching autonomous vehicle operations in Zagreb, Croatia, in partnership with local startup Verne and Chinese artificial intelligence company Pony.ai.

The companies began offering robotaxi rides in Zagreb in April, with vehicles initially operating under the supervision of human safety operators. After covering 200,000 kilometres on the city’s roads, the partnership has started limited fully driverless trips and is preparing to expand to Manchester in the United Kingdom.

The first fully driverless journeys began on September 10 for a limited group of invited users. The service operates along a 22-kilometre route connecting Verne’s headquarters with Zagreb’s Franjo Tuđman Airport.

Uber is also considering more than 30 European cities for potential expansion, with projects at different stages in London, Madrid, Munich and Zurich.

Passengers using the existing service can select autonomous rides when booking UberX or Comfort journeys through the platform. They can unlock the vehicle using their phones and access Uber support during the trip.

The vehicles are BAIC Arcfox Alpha T5 electric SUVs manufactured in China. Uber and Verne currently operate about 30 autonomous vehicles in Zagreb, which return to a central facility each night for cleaning and maintenance.

Although the initial service includes a safety operator, the latest trials are designed to demonstrate that the vehicles can complete journeys without anyone behind the wheel.

Annie Duvnjak, Uber’s global head of autonomous mobility operations, described the experience as “a little bit magically boring”, explaining that passengers initially notice the absence of a driver before becoming accustomed to the journey.

The vehicles follow traffic rules cautiously, stopping at stop signs even when roads are empty and pulling over when confronted by aggressive drivers. The companies are using the trials to assess performance and improve the technology before expanding operations.

The programme operates within a restricted area and falls under Level 4 autonomous driving, which allows vehicles to operate without human intervention under specified conditions. Level 5 autonomy, which would permit unrestricted operation in all driving environments, has not yet been achieved commercially.

Pony.ai supplies the technology through its Virtual Driver system, which uses artificial intelligence to control the vehicle. The cars are equipped with 34 sensors, including nine LiDAR sensors, 14 cameras and four millimetre-wave radars, alongside microphones and other detection equipment.

Dr Ludi Wang, Pony.ai’s director of global communications, said the system is trained in a virtual environment before being deployed on public roads. The training process allows the AI to learn driving behaviour without relying on remote control during journeys.

Verne, co-founded by Croatian entrepreneur Mate Rimac, manages the fleet, daily operations and regulatory approvals. The company has worked on autonomous mobility since 2019 and is developing its own robotaxi service.

Uber provides the booking platform and passenger experience, while Pony.ai contributes autonomous driving technology. The companies say their partnership combines expertise from the United States, Europe and China despite differences in their regulatory approaches and technology policies.

Manchester is expected to become the partnership’s next European destination, with testing already under way and a potential service launch in the coming months.

Verne executive representatives have also confirmed discussions with Brussels, although any expansion will depend on whether the city can eventually support a fully driverless service. The companies say their broader ambition is to establish commercially viable autonomous taxi operations across Europe.