Hello from the bunker.
The robots have learned to pick locks, cheaply and in bulk. Reuters reported that one hacker set a pack of AI agents loose on more than 1,200 websites and got into over 100 of them, at roughly $50 a break-in.
Then, two days later, it turned out PHP, the software behind roughly 7 in 10 websites, had two serious holes, found with help from AI. Some government sites went dark while they patched, and on Monday the US government's cyber agency said attackers are now using them. Australia's cyber agency, meanwhile, says AI has become the defining force in online threats over the past year. The good news: the robots mostly try the doors that are already open.
So this is a security issue, with one job per level. This weekend: lock down your own accounts in half an hour, freeze the family's credit for free, put a spending cap on any work account that can spend, send your web person five questions, and switch on the free scam guard already sitting in your browser.
The most useful things to try this weekend.
A hacker set AI agents loose on more than 1,200 websites and got into over 100, at roughly $50 a break-in. Cheap attacks try everyone, so the basics matter more than ever.
With AI making break-ins cheap, assume some of your details are already loose. A free credit freeze at all three bureaus stops anyone opening new credit in your name.
Hackers took stored AI account keys from a slice of OpenCode's users and ran up charges, some over $1,000. Any work account that can spend needs a limit and an alert.
AI agents went after 1,200+ websites, mostly online shops, and serious new flaws turned up in PHP, the software behind many small-business sites. Five questions to put to whoever runs yours.
Chrome's Enhanced protection setting now uses Google's Gemini AI to flag fake virus and fake update pages, and warns before you paste a 'ClickFix' command. It's free, but it isn't Chrome's default setting.
Not quite, but it was a real scramble. On October 21, PHP, the software that runs roughly 7 in 10 websites, released fixes for two serious flaws that can let an attacker take over a server running an old version. AI tools helped the security firm Wiz and an OpenAI-led effort find them first. The FBI told site operators who couldn't update right away to take their sites offline, and some government sites in the UK, Finland and Japan briefly went dark while they patched. Japan's government said it had no reports of damage.
That's where the "70% of websites" headlines came from: it's the share of sites that use PHP, not the number that were at risk or hacked. The risk is real for sites that haven't updated, though. On October 26, the US cyber agency CISA said the flaws are now being exploited in attacks and gave federal agencies until October 29 to fix them. Since then, security firms have reported attackers going after unpatched servers and firewalls; one says it found three hacked servers inside a US government-affiliated network. No victims have been named. The scanning firm Censys still counted more than 32 million PHP services on an affected version.
What comes next is more of the same, faster. AI is now digging up old holes in everyday software, which is good news when the fix ships first and bad news for anyone who doesn't install it. One security expert told the AP this is "just the very early tremors." Another said we shouldn't treat it as a scenario where we're all doomed. We agree with both.
What to actually do: You can't patch the internet, but you can patch your corner of it. Turn on automatic updates on your phone, computer and Wi-Fi router, and restart when they ask. If you have a business website, ask whoever runs it one question this week: "Are we on the October 21 PHP fix?" Then keep the boring habits in this issue: unique passwords, two-step login, a credit freeze. They work whichever hole is in the news.
A man finds a polar bear cub that can't walk, nurses it for a year and releases it into the wild. An officer helps a mother bear free her cub from a highway barrier. Both clips spread on social media in the past few weeks. Both were made by AI.
Fact-checkers at Lead Stories traced the polar bear video to an Instagram account whose bio says it makes AI-generated videos, and the original post carried an AI label. Detection tools found an AI watermark in parts of it. The bear-cub clip scored high on an AI detector and carried a hidden watermark from an AI video tool. Feel-good animal videos are cheap to make and easy to share, which is exactly why they're everywhere.
Copy this into ChatGPT, Claude or Gemini. List your accounts and devices, never your passwords.
I want to do a 30-minute security checkup on my own accounts and devices. Act as a patient coach. Here is a list of my accounts and devices, without any passwords: [list, e.g. Gmail, bank, credit card, Amazon, iPhone, Windows laptop, home Wi-Fi router]. 1. Put them in order of what to secure first, starting with my email. 2. For each, tell me in plain steps how to turn on two-step login or a passkey and where to find the setting. 3. Remind me to turn on automatic updates for each device. 4. End with a one-page checklist I can tick off. Never ask me for a password, code or account number, and remind me not to type them here.
Head for the bunker (9): “I just saw a headline that read: 'The AI-Hacking Apocalypse Began Last Night.' Seems like the end may be near.”
Headlines love an apocalypse. So do we, it's in the name. What actually changed is that break-ins got cheap, which means the boring locks matter more. Half an hour this weekend puts you behind most of them.
Head for the bunker (9): “These days I'm worried that one day we'll wake up and everyone's bank account will be empty. Also worried that something in the news will cause a run on the banks.”
Two different worries, two answers. A run on the banks: deposits at FDIC-insured banks are covered up to $250,000 per depositor, per bank, per ownership category if the bank fails. A thief emptying your account: that's what two-step login and account alerts are for, and if a transaction looks wrong, call the number on your card the same day.