Security experts are calling this week 'Black October', but they say that by next year, outbreaks of this scale will be routine, or even mild. The reason is that AI has dropped the barrier to launching cyberattacks to almost nothing.
This may have been the worst week in the history of cybersecurity. Two major vulnerabilities in PHP, which runs 70 percent of the web, prompted governments, hospitals and companies to take services offline as a precaution. There have already been millions of attempts to exploit them.
The same day, vulnerabilities or successful hacks were announced in several major products and platforms used by Netflix, PayPal, Walmart and others. Yesterday, Quest Diagnostics, which runs lab tests for a third of American adults each year, disclosed it had been breached too. A senior vice president at Palo Alto Networks paused when asked about yet another hacked cloud platform: 'I didn't see that one. It's been quite a busy week.'
AI turned hacking into a free group buy
Cloudflare's CEO says that for the next year or two, the internet is going to feel like the sky is falling. There is a decades-long backlog of bugs in software written without much review. In the past, with only a small number of skilled hackers, that was more or less fine. Now it is not.
Open-source models can be downloaded for free and used without restrictions, and in the past couple of months they have become very good at finding vulnerabilities and automating attacks. Malicious activity has spiked. More sites will be defaced, more personal data stolen, and ransomware will spread.
The skill threshold has become absurdly low. CrowdStrike tied a spate of attacks on South Korean banks late last month to a 26-year-old in China. After getting access to all the data, he asked AI: 'How do I monetize this? Where can I sell this?' He 'didn't know what he was doing.'
Every little site you use is a door
Node.js was also hit with vulnerabilities this week. Fortune 500 companies and AI-built programs rely on it. 'These are the things the web runs on,' an expert said. Compromise one product that uses it, and tens of thousands of organizations can be infected through a supply-chain attack.
The advice people are getting: don't host your own email client or home file system, because Google and Dropbox have the resources to withstand an onslaught of AI hacks and you don't. Delete unused browser extensions. Don't assume every site you use is secure -- that Pokémon trading-card site, fantasy-sports platform or birding forum could be hacked for a password you reused elsewhere.
Eventually, AI may help find and fix many of these flaws. But until then, we are stuck in a terrible limbo: rewriting and securing the billions of lines of code that have always had these vulnerabilities, for as long as it takes.
The fork in the road is what unsettles me most: either the web becomes more open, with anyone able to run AI security checks, or it becomes more centralized, with only big providers deemed trustworthy. We may need new walls, but we may also end up walled in.
Why it matters
For twenty years, people treated 'typing your credit-card number into any site' as the internet's default setting. Once AI drives the cost of an attack close to zero, that default is over. Individuals and companies both need to start subtracting -- fewer entry points, less trust in the default.
Curated from high-quality sources, with concise summaries and key takeaways.
