Japanese internet infrastructure company GMO Internet will compensate customers for financial losses linked to unauthorised trading following a cyberattack on its cloud service. The company will also pay ¥5,000 (€28) to every customer currently using the affected service, regardless of whether they suffered losses.

The attack targeted Onamae.com Desktop Cloud, a virtual private server service that allows customers to access remote desktop environments. GMO said customer information had been stolen and some users had reported transactions in their securities and foreign-exchange accounts that they had not authorised.

According to founder and chief executive Masatoshi Kumagai, the incident potentially affected 26,739 servers and involved unauthorised activity on trading accounts held with more than 70 securities and foreign-exchange firms in Japan and overseas.

GMO shares fell almost 16% on Monday, reaching a four-month low. The company had a market value of approximately $2.6 billion at Friday’s close.

GMO began investigating the incident on 19 October after receiving an inquiry from a customer. The company confirmed the installation of malicious software in some customer server environments the following day. It then suspended new applications and access to the service’s control panel before beginning to shut down all servers on 21 October to limit further damage.

In a blog post published on Sunday, Kumagai apologised for the company’s handling of the incident. He acknowledged that security specialists had identified concerns before the attack but said the company’s response had been insufficient.

GMO also disclosed that it had received a ransom demand from a party believed to be responsible for the attack. In an update to his blog on Monday, Kumagai said the attackers had demanded $50 million in cryptocurrency and threatened to release company and customer information.

The company has refused to pay the ransom and is cooperating with police and other authorities.

Customers who wish to continue using a Windows desktop environment will be offered an alternative service operating on independent cloud infrastructure, free of charge for six months. GMO also plans to redesign its security architecture and investigate the breach with external experts.

Kumagai has called on the Japanese government to strengthen its active cyberdefence capabilities, arguing that private companies cannot tackle sophisticated cross-border attacks alone. GMO has asked authorities to consider applying the framework to the incident and offered to share evidence and technical information with investigators.

The breach comes amid wider concerns about digital security, following the disclosure of two critical vulnerabilities in PHP, a programming language widely used to build websites and applications. Security authorities warned that the flaws could allow malicious code to run on vulnerable servers, although GMO has not confirmed any connection between those vulnerabilities and the attack.

A separate Google Cloud outage in the United Kingdom last week disrupted online services, including those operated by financial technology company Revolut, highlighting the wider consequences of disruptions to digital infrastructure.

Parents in France are underestimating how frequently their children use artificial intelligence, while many say they lack the support needed to guide them towards responsible use, according to a new YouGov survey commissioned by Berlin-based non-governmental organisation Interface.

The survey found that 40% of children aged 11 to 12 use general-purpose AI services, such as ChatGPT, every week. However, only 26% of their parents were aware of this use, a gap of 14 percentage points.

The research, conducted online between June 24 and 30, included 1,138 parents of children aged 11 to 17 and 970 children in the same age group. It examined the use of several AI technologies, including chatbots, digital companions, voice assistants and AI features built into social media platforms.

The findings suggest that AI tools are becoming part of children’s lives at an early age. Among respondents aged 11 to 12, 56% said they used at least one type of generative AI tool weekly. General-purpose AI services were used by 40%, while 33% reported using voice assistants. Another 23% used AI features embedded in social media, and 16% said they interacted with AI companions.

Jessica Galissaire, a senior policy researcher at Interface, said AI chatbots could function like always-available companions because they do not tire and may consistently agree with users. She also raised concerns about younger children accessing services whose age requirements they do not meet. Character.AI, for example, requires users in the European Union to be at least 16 years old.

The survey found that parents consistently underestimated AI use across age groups. Among children aged 13 to 15, 62% reported regular use, compared with their parents’ estimate of 52%. For teenagers aged 16 to 17, the figures were 70% and 61%, respectively.

Time spent using these services was another concern. According to Galissaire, 92% of generative AI users said they spent more time on the technology than they intended. AI companions and AI features integrated into social media recorded particularly high levels of unwanted extended use, at 59% and 57%, respectively.

Parents also reported limited support in helping their children navigate AI. Only 32% felt sufficiently supported, while 26% said they received some support but not enough. The remaining 42% said they received no support at all.

When asked who should help protect and educate children about AI, 51% of parents identified teachers and schools, while 41% pointed to technology platforms and 30% to public authorities.

The findings come as the European Union considers its proposed Kids Act, which aims to strengthen platform accountability through measures including age limits, parental controls and restrictions on features considered addictive.

Galissaire argued that regulation alone would not address the risks. She favoured requiring platforms to be safe by design, alongside prevention and education, warning that age restrictions could create a false sense of security if parents stopped monitoring their children’s online activities.

Artificial intelligence helped uncover two critical security vulnerabilities in PHP, a programming language used by about 70 per cent of websites worldwide, prompting government agencies, businesses and online platforms to take services offline while installing emergency fixes.

The flaws had remained undetected for more than a decade and could allow attackers to execute malicious code on vulnerable servers without logging in. The discovery triggered precautionary shutdowns across Europe, affecting services ranging from the Netherlands’ digital identity system and parliament website to government portals, hospitals and commercial platforms.

The Netherlands temporarily took its DigiD digital identity service, the Overheid.nl government portal and the lower house of parliament’s website offline. Finland’s state IT provider, Valtori, suspended government web services, while France and Germany also restricted access to several public websites.

CERT-EU, the cybersecurity service for European Union institutions, advised organisations unable to apply the fixes immediately to take affected websites offline. European institutions and national cyber response teams jointly urged operators to prioritise internet-facing systems.

PHP, originally named Personal Home Page, handles behind-the-scenes website functions such as processing payments, checking user logins and delivering content. It underpins widely used platforms including WordPress, Drupal and Joomla, making vulnerabilities in the language a potential threat to millions of online services.

The PHP Foundation released security updates on Wednesday and urged administrators to upgrade immediately. Patched versions include PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Older versions no longer receiving official updates should be considered vulnerable unless suppliers have applied the fixes separately.

The vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619, received severity ratings of 9.2 out of 10. They affect areas involving memory management and error handling, potentially enabling remote code execution under specific conditions.

The PHP Foundation said developers had identified early signs of the problem during an external audit in 2024, but efforts to develop a practical exploit and determine an appropriate fix stalled for months. It described the delay as “a structural failure”.

Artificial intelligence subsequently helped researchers establish working attack methods. Security firm Calif identified a functional remote attack in August during an OpenAI-funded audit using OpenAI’s GPT-5.6 Sol model. OpenAI independently identified the same issue, while Wiz later found additional attack methods using its Wiz Atlas tool, Google’s Gemini 4 Argon and GPT-5.6 Sol.

Wiz researchers said one researcher had completed in a week work that might previously have required a specialist team months to accomplish. OpenAI described the findings as “one of the most impactful vulnerabilities in recent memory”.

The vulnerabilities were initially disclosed privately while developers prepared a patch. However, the identifiers leaked online on Tuesday, prompting PHP to bring forward the release. Technical details and proof-of-concept material subsequently circulated, increasing fears that attackers could quickly develop working exploits.

Security experts stressed that taking websites offline did not necessarily mean they had been compromised. The PHP Foundation said its security team found no functional exploit in the proof-of-concept material circulating when the patch was released.

However, Cloudflare reported observing attack traffic targeting its customers on Wednesday, while CERT-EU warned that public disclosure increased the likelihood of active probing.

Experts warned that smaller businesses and independently operated websites could remain exposed for weeks or months if their administrators failed to apply updates. Even organisations that patch their own systems may face risks from third-party services that remain vulnerable.

The incident has also renewed calls for stronger investment in software security. The PHP Foundation relies on a relatively small group of funded developers and volunteers to maintain technology used by governments, banks and online retailers worldwide. Researchers say AI can accelerate vulnerability discovery, but experienced engineers remain essential to developing safe fixes and protecting interconnected systems.