Affected people can seek credit monitoring, identity-theft restoration services and cash payments; claims are due Jan. 21, 2027

NordVPN, Surfshark, ExpressVPN, Proton VPN, and Norton VPN each win a different category in a 2026 ranking of VPNs.

The startup, valued at $1.5 billion in January, is now worth $3.8 billion after a round led by Bessemer Venture Partners

Cyprus already has a relatively demanding framework for reporting cyber incidents, with a 6-hour early warning deadline and a fuller notification requirement within 72 hours, but the country must ensure its institutions can respond effectively as artificial intelligence accelerates cyber threats, according to a new report by the Digital Cooperation Organisation (DCO).

The findings appear in the organisation’s September 2026 edition of DCO Policy Watch, titled ‘Resilience at Machine Speed: National Cyber Defense in the Age of AI‘, which examines how governments can strengthen their defences against increasingly automated attacks and prepare for the eventual transition to quantum-resistant cryptography.

The report places Cyprus among jurisdictions with a defined incident-reporting interval in force, noting that its Article 35B requirements establish a tighter initial reporting timeframe than the default under the European Union’s NIS2 Directive.

However, it cautions that having a deadline does not automatically mean a country can respond effectively, with the resources, staffing and operational capabilities behind the rules ultimately determining their value.

For Cyprus, the broader lesson is that existing reporting requirements should form part of a comprehensive national strategy that connects early warnings to effective incident response, investment in defensive artificial intelligence and preparation for future cryptographic risks.

The report argues that cyber resilience is not simply a level of protection a government purchases, but the ability to detect an intrusion, contain it, maintain essential services and recover afterwards.

That capacity must be built, staffed and tested before an attack occurs.

The urgency is increasing. CrowdStrike’s observations of financially motivated cybercrime in 2025 found that the average time taken by an intruder to move from an initially compromised machine to a second machine had fallen to 29 minutes, while the fastest observed case took just 27 seconds.

In July 2026, autonomous AI agents operated by OpenAI conducted a four-and-a-half-day campaign that included an intrusion into the production infrastructure of Hugging Face, the largest public repository of open-source AI models.

The agents were given objectives, tools and permission to act across multiple steps without a person directing each individual action, illustrating how attacks can unfold with little or no immediate human intervention.

The report warns that the time available for people to make decisions during an incident is shrinking, making advance preparation increasingly important.

The financial consequences of inadequate preparation are illustrated by Costa Rica, where a ransomware campaign in 2022 prompted a response across 10 institutions that the country’s Comptroller General assessed at roughly 14 times the institutions’ combined cybersecurity spending in the preceding year.

Costa Rica had a national strategy, a designated ministry, a response team and an audit that had identified the ministry that subsequently failed.

What it lacked, according to the report, was sufficient funding, an operational plan and an enforceable reporting obligation.

The DCO identifies three pillars of national cyber resilience that governments, including Cyprus, should prioritise.

The first is establishing the institutional foundations needed to respond to incidents, including a published national strategy, a designated authority, clear reporting requirements and deadlines, and a trained workforce.

The report says these components are complementary rather than interchangeable, warning that a reporting duty has limited value if the receiving team lacks the capacity to act.

Although incident-reporting obligations exist across almost all DCO member states, measurable deadlines are less consistently established.

It recommends that governments attach clearly defined reporting intervals to existing legal obligations, taking account of the severity of incidents and the information reasonably available, while ensuring the receiving institutions have the resources to respond.

Ghana provides one example, requiring incidents to be reported to the relevant sectoral or national team within 24 hours of detection.

The second pillar concerns artificial intelligence and the changing balance between attackers and defenders.

The report distinguishes between human attackers using AI to discover vulnerabilities more quickly, autonomous AI agents acting without continuous human direction, and defensive applications of AI that help security teams identify weaknesses, assess incidents and test systems.

It says public evidence is not yet sufficient to establish whether AI overall favours attackers or defenders, but stresses that offensive tools are becoming more accessible.

A campaign against government systems reported in August 2026 was assembled using open-source agent frameworks, illustrating that sophisticated capabilities are not necessarily restricted to the companies developing the most advanced AI models.

The report therefore recommends stronger basic security controls, greater use of AI for defensive purposes and coordinated governance of advanced AI systems.

It also urges governments to record the degree of automation involved in cyber incidents, rather than relying exclusively on classifications of attack techniques.

Such reporting should allow an incident to be marked as “unknown” when the available evidence cannot establish whether actions were automated or directed by a person.

Singapore’s June 2026 guidance on securing agentic AI provides an example of how governments can identify vulnerabilities in automated workflows and apply appropriate safeguards.

For Cyprus, the findings point to the importance of ensuring that existing cyber security procedures account for attacks involving autonomous systems, while testing whether defensive AI tools can perform useful work under real incident conditions.

The report notes that, during the July 2026 Hugging Face incident, commercial AI models initially used by responders refused much of the forensic work because their safeguards could not distinguish between someone investigating an attack and someone conducting one.

An open-weight model running on the platform’s own hardware subsequently helped responders decode staged payloads, demonstrating the value of testing alternative tools before an emergency arises.

The third pillar is preparing for quantum computing, which could eventually undermine some of the public-key cryptographic systems currently used to protect data and authenticate communications.

The report warns of the “harvest now, decrypt later” risk, in which attackers collect encrypted information today in the expectation that future computing capabilities will allow them to decipher it.

Because replacing vulnerable cryptography across government systems can take years, preparation should begin before quantum computers capable of breaking existing protections become available.

The first step is to establish an inventory of the cryptographic algorithms used to protect information in transit and at rest, as well as those used to verify identities.

The report says this can begin without specialised quantum expertise or new procurement.

It recommends introducing inventory requirements through existing regulatory instruments, updating national cryptographic standards to include quantum-resistant algorithms and amending rules governing public key infrastructure, including electronic signatures and trust services.

Governments should then develop funded migration plans that identify responsible institutions, prioritise systems according to risk and establish testing and completion milestones.

The United States has estimated that migrating prioritised federal systems, excluding national security systems, will cost €6.25 billion ($7.10 billion), illustrating the scale of the investment involved.

The report also highlights how long cryptographic transitions can take, citing 22 years between the publication of the Advanced Encryption Standard and the National Institute of Standards and Technology’s cutoff for applying new protection with Triple DES, and 25 years between the first theoretical attack on SHA-1 and its planned retirement in 2030.

The DCO’s proposed roadmap divides action into three stages, beginning with foundational measures that allow governments to understand their own systems, progressing to operational capabilities, and culminating in advanced capabilities that member states can develop more effectively through cooperation.

Alongside reporting deadlines and cryptographic inventories, it recommends identifying essential services that should receive priority protection, ensuring cyber response teams are staffed around the clock and testing defensive AI tools before they are needed.

The report concludes that much of the initial work involves improving existing laws, procedures and administrative systems rather than developing new technology.

However, sustained funding is still required to maintain specialist teams, train and retain staff and complete cryptographic migration.

For Cyprus, the priority is to build on its existing reporting framework by ensuring that warnings lead to effective action, while starting the long-term work of mapping and upgrading vulnerable cryptographic systems.

The report argues that governments can make substantial progress using authorities and resources they already possess, while regional cooperation can help share the cost of capabilities that would be difficult for individual countries to maintain.

Its central message is that the time available for institutional preparation remains, even as the time available to intervene during an attack continues to shrink.

Restrictions on suppliers, changes in procurement policies and replacement of existing ICT infrastructure affect supply chains.

On Tuesday, SEO Amsterdam Economics reported that a proposed revision of the European Union’s Cybersecurity Act, known as CSA2, could lead to losses ranging from 290 million euros (US$324 million) to 2.2 billion euros (US$2.46 billion dollars) for Dutch businesses in the first year of implementation.

RELATED:

Artificial Intelligence Pioneers Call for International Body to Oversee Cybersecurity Standards

The report, titled The Price of Security and commissioned by the Netherlands China Business Council (NCBC), cautions that the impact could extend beyond businesses directly affected by the restrictions, spreading through supply chains and hitting firms in other sectors of the Dutch economy.

The legislation was proposed by the European Commission at the beginning of this year. The draft introduced “non-technical risks” in the name of cybersecurity and supply chain security.

In particular, the draft would identify “countries posing cybersecurity concerns” and “high-risk suppliers,” and exclude listed countries and suppliers from relevant EU supply chains across 18 sectors, including energy, transport, and information and communications technology.

However, the economic implications of restricting suppliers could be substantial, particularly for businesses that rely on existing information and communications technology infrastructure and have limited short-term alternatives, according to the report.

🚨🇪🇺 BREAKING: Critical software vulnerabilities trigger government website shutdowns across at least SIX European countries, affecting public authorities, hospitals, schools and critical infrastructure.

Two severe security flaws have been discovered in PHP, one of the world's… pic.twitter.com/Z89nsKbVsK

— Coffe Report (@CoffeReport) October 21, 2026

Companies may also need to modify existing systems, adjust production processes and reorganize supply chains to accommodate replacement products. These changes could generate additional costs beyond the losses estimated in the report.

“Security measures do not exist in an economic vacuum,” NCBC Chairman Jochum Haakma said at a seminar on the report on Monday, adding that restrictions on suppliers, changes in procurement policies and the replacement of existing ICT infrastructure can affect entire supply chains, investment decisions and ultimately the competitiveness of the European economy.

In a letter to parliament on June 19, Dutch Minister of Justice and Security David van Weel said the government was concerned about the European Commission’s proposed power to designate entire countries and suppliers as high-risk, citing potentially far-reaching economic, legal and geopolitical consequences, as well as insufficiently clear and detailed criteria and procedures.

The report notes that restrictions on supplier choice could also yield other adverse consequences, as diminished competitive pressure may result in higher prices, lower quality and reduced innovation.

“Strategic autonomy is an important European ambition, but autonomy should not lead to isolation,” Haakma noted.

teleSUR/ JF

Source: Xinhua

GMO Internet is refusing to pay as the attackers disclosed one customer's personal information and say more will follow

• Cybersecurity experts found severe PHP bugs that could allow attackers to hijack web servers.
• AI is being used to exploit vulnerabilities, making Americans more susceptible to scams.
• Experts stressed basic cyber hygiene and scam awareness, especially for older Americans.

In just two days, AI exposed critical flaws in a programming language behind 70% of all websites. That may have opened the door for a rush of scams — especially those targeted to vulnerable populations like older Americans.

Last week, cybersecurity researchers uncovered two severe bugs in the PHP programming language. Attackers could hijack web servers and execute remote code. This prompted the PHP Foundation to release emergency patches to prevent widespread hacks, and governments, cybersecurity agencies, and businesses quickly moved to do damage control.

Though some experts said there could have been more problems had these flaws not been immediately addressed, such a crisis can happen again. As AI becomes more advanced and widespread, Americans are becoming more exposed and susceptible to scams.

Scams have been pervasive for decades, starting with physical mail and landline telemarketing. But they've gotten significantly more complex and deceptive, now integrating AI in ways that even tech whizzes may not spot. Older Americans are often the main targets of fraud, losing billions in fraud. An AARP survey from April found that 4 in 10 older Americans have lost money to fraud.

With attackers pouncing on any vulnerability to steal personal details or get money, five experts told Business Insider that now is the time to get ahead on scam prevention. Their quotes have been lightly edited for length and clarity.

Journalists from 17 European public service broadcasters, coordinated by the European Broadcasting Union’s (EBU) Eurovision News Spotlight network, published an interactive map on 23 October 2026. It documents hybrid incidents linked to Russia across 17 European countries between 1 April and 15 October. Journalists compiled a database of hundreds of reported incidents, categorizing each by type and the source and strength of its alleged links to Russia, then verifying them through open-source research.

The map comes as officials warn the campaign is growing. On 28 September, EU foreign policy chief Kaja Kallas said in Brussels that Russia was planning more acts of sabotage to divide societies and intimidate them into abandoning their support for Ukraine. The points on the map represent an incomplete list of publicly known cases attributed to Russia or suspected of being linked to it, the report states.

The map covers airspace violations, sabotage attempts, “disposable” agents with no formal intelligence training, migration used as a weapon, and Russian military activity near or across European borders. It excludes cyberattacks, influence operations, and espionage by trained intelligence officers.

The EBU calls the result a very conservative estimate, not an official tally. Russia has consistently denied responsibility for the incidents. Many single points represent several incidents of the same type in one area or in quick succession. In Moldova, for example, Defense Minister Anatolie Nosatîi said on 30 September that the government had recorded 84 drone incursions.

Four German incidents are on the map, out of many more

The map shows four incidents in Germany, according to BR.

• On 2 August, German authorities arrested a 33-year-old Ukrainian man in Thuringia on suspicion of photographing a Bavarian weapons manufacturer for a foreign intelligence service as part of an alleged sabotage plot.
• On 4 August, a drone carrying explosives and a detonator struck the wing of a Ukrainian An-124 cargo plane at Leipzig/Halle Airport but failed to explode.
• On 3 September, attackers threw firebombs from a car onto a construction site next to defense firms in Munich, and German security authorities suspect Russian intelligence.
• On 14 September, investigators learned of a crashed drone found near the Bundeswehr’s Wunstorf air base.

Internal papers from the new Joint Hybrid Defense Center, seen by Correctiv, record 163 suspected sabotage cases in 2026 up to 19 August. The targets included rail lines, military facilities, substations, and radio masts. The same papers record 1,034 drone overflights of critical infrastructure, military sites, and defense companies, and 25 espionage investigations. The papers cover possible attacks by Russia, China, and Iran, and media did not report a breakdown of the sabotage cases by country.

European leaders sound the alarm over Russian hybrid attacks

On 15 April, Swedish civil defense minister Carl-Oskar Bohlin said pro-Russian groups had moved from denial-of-service attacks to attempts at destructive cyberattacks, including one on a Swedish power plant in 2025. On 1 September, German Foreign Minister Johann Wadephul named Russia as the perpetrator of the Leipzig attack and accused Moscow of “blatant hostility” toward Germany.

On 18 September, French President Emmanuel Macron said Russia’s hybrid attacks would not go unanswered and ordered a plan to protect France’s critical infrastructure. On 1 October, German Chancellor Friedrich Merz said Germany was preparing for new hybrid attacks, “including serious ones.” NATO Secretary General Mark Rutte on 14 October called the attacks a sign of Russian weakness at a press conference in Tallinn and said NATO would react where needed without being “rattled.”

Anthropic said Claude stayed out of Georgia's voter registration system and changed or pulled no voting records

A delegation from the European Parliament has begun a three-day mission to Bosnia and Herzegovina to examine foreign interference in the country’s political institutions, electoral processes and public information environment.

The visit, taking place from 26th to 28th October, comes three weeks after parliamentary elections exposed persistent divisions over Bosnia’s political direction and its prospects of joining the European Union.

The mission is being conducted by Parliament’s Special Committee on the European Democracy Shield, chaired by French MEP Nathalie Loiseau. Its purpose is to assess vulnerabilities to disinformation, cyberattacks, economic pressure and other forms of hybrid interference, and to identify measures that could strengthen Bosnia’s institutional resilience.

According to the European Parliament’s announcement, the delegation will meet government officials, parliamentary representatives, civil society organisations, journalists and researchers. Joining Loiseau are Finnish MEP Mika Aaltola, Portugal’s Ana Catarina Mendes and Romania’s Cristian Terheş.

The investigation comes at a politically sensitive moment. Bosnia’s general election on 4th October confirmed the persistence of competing political priorities between the country’s constituent entities, with pro-Russian politician Milorad Dodik’s Alliance of Independent Social Democrats retaining considerable support in Republika Srpska.

As EU Today reported following the election, parties favouring closer European integration also performed strongly, particularly in the Bosniak-Croat Federation. The resulting political balance will influence the formation of new administrations and their ability to implement reforms demanded by Brussels.

From electoral interference to institutional security

The European Parliament’s investigation extends beyond conventional disinformation campaigns.

MEPs intend to examine how foreign actors may exploit weaknesses in electoral administration, cybersecurity, political financing and the country’s wider economic relationships. They will also consider the role of digital platforms in distributing manipulated information and the legislative gaps that could make interference difficult to identify or prosecute.

The distinction matters in Bosnia, where political influence cannot be separated from the country’s complicated constitutional arrangements.

Under the Dayton peace settlement, the state operates through institutions that distribute authority between the Federation of Bosnia and Herzegovina, Republika Srpska and the central government. Political disagreements can therefore obstruct decisions requiring cooperation between different levels of administration.

External actors seeking influence may exploit those divisions, although identifying a political relationship with a foreign government is not, by itself, evidence of unlawful interference.

The European Union has repeatedly expressed concern about Russia’s activities in the Western Balkans, particularly its relationships with political forces opposing closer integration with European institutions. Chinese investment and economic relationships also raise questions about strategic dependence, although legitimate commercial activity must be distinguished from coercion or covert political operations.

The delegation’s task is to establish which vulnerabilities can be substantiated and whether existing safeguards are adequate.

Accession negotiations remain incomplete

Bosnia received EU candidate status in December 2022. In March 2024, European leaders agreed in principle to open accession negotiations, but progress has remained conditional on institutional and legal reforms.

Following the October election, EU foreign policy chief Kaja Kallas and Enlargement Commissioner Marta Kos issued a joint statement calling for the prompt formation of new administrations and progress on judicial reform.

The Commission also highlighted shortcomings identified by international election observers, including technical difficulties, complicated voting procedures and concerns about ballot secrecy.

Those findings do not automatically establish foreign interference. They do, however, demonstrate why the integrity of electoral institutions remains central to Bosnia’s relationship with Brussels.

A test for the European Democracy Shield

The Sarajevo mission follows the EU’s decision on 13th October to include enlargement partners in the European Centre for Democratic Resilience.

The initiative is intended to improve cooperation on election security, information manipulation, crisis management and institutional protection before candidate countries enter the Union.

EU Today has previously examined the European Democracy Shield’s proposed mechanisms, including closer coordination with technology companies and improved systems for identifying foreign information operations.

Bosnia now offers a practical opportunity to examine whether those instruments can operate effectively in a country where political authority is fragmented and accession remains incomplete.

The delegation’s findings could inform recommendations on institutional cooperation, election safeguards and support for independent media. Any substantial improvement, however, will depend on the willingness of Bosnia’s authorities to implement reforms and enforce existing legislation.

For Brussels, the immediate issue is whether its emerging framework for democratic resilience can provide practical protection to candidate countries while respecting their political sovereignty and the freedoms it is intended to defend.

• All hell broke loose this week after a security flaw in 70% of the world's websites was made public.
• It was supposed to be kept under wraps as a fix was deployed, but one researcher jumped the gun.
• Chainguard CEO Dan Lorenc told POLITICO why he decided to go public.

The exposure was immense, with AI multiplying the risks — and yet time-tested global cybersecurity procedures appeared to be functioning. Then suddenly, it all broke down.

The decision by a cybersecurity company on Wednesday to prematurely release information about a flaw in the popular PHP computer programming language left much of the web exposed to hackers, triggering a panic that brought to life months of warnings of how the AI-powered era could cause widespread damage.

The flaws in PHP, discovered using AI tools through a monthslong process coordinated by OpenAI, caused cyber agencies across Europe, the US, the UK, Australia and Canada to post urgent warnings Wednesday. Numerous governments took websites offline as a precaution.

While no major hacking damage was immediately apparent, the way the incident unfolded over 72 hours showed how easily cybersecurity processes can break down and the outsized consequences of cyber risks in the AI era.

The man who set off the chain reaction with the early release — Chainguard's CEO Dan Lorenc — quickly apologized in a LinkedIn post. But on Thursday, in an interview with POLITICO, Lorenc said he'd shared the information ahead of time because the flaw was already being exploited. Though others disputed that, Lorenc said he believed he'd seen enough evidence to invalidate an embargo set up to allow time to find a fix for the flaws.

While he disputed that his actions would have caused problems for other defenders, Lorenc said that the evidential threshold in these coordinated cyber defense systems is a "grey area."

The revelation of the PHP flaw brings out into the open what cyber officials have been bracing for since the arrival of the most powerful tools of artificial intelligence, which not only can be used to discover vulnerabilities but also to exploit them at scale.

The cybersecurity world's long-established protocols helped prevent disaster scenarios in which hackers would have successfully exploited the vulnerabilities to take control of numerous websites and access their data. But the scale and end-of-days potential of AI-driven cyber risks are now visible for the world to see.

This "is what happens when AI turns up a flaw that's been hiding for years," said Eylam Milner, cofounder and chief technology officer at cybersecurity startup Echo. The vulnerabilities, he added, are "about as serious as it gets for the web."

Origin story

Understanding how this week's emergency unfolded offers a glimpse at how companies and authorities are working to stave off attacks — and how much risk they face going forward.

The origins of the incident can be traced back as far as April, when leading frontier AI firm Anthropic unveiled Mythos, leading some in the cybersecurity world to worry that systems would quickly be overrun by advanced artificial intelligence, with potential for catastrophic events to ensue.

But while researchers did find more flaws in computer systems in the months after Anthropic and other AI firms like OpenAI released those models, they had little impact in the real world. Even the Hugging Face incident, a widely discussed hack that saw OpenAI's autonomous AI agents go rogue during an internal security evaluation, related more to the level of control AI companies exert over their models than their power to break into systems worldwide.

That changed this week after researchers unveiled the vulnerability in PHP, a coding language estimated to be integrated into some 70% of the web.

The process by which information about flaws is released among cybersecurity officials and affiliated companies is crucial. Through a long-standing practice known as coordinated disclosure, researchers and companies that identify flaws can find a fix and share it confidentially with agencies and others before releasing it to the public, meaning they don't hand malicious hackers the gift of a hole without a fix.

In the case of the PHP flaw, that process worked well, but not perfectly. Information about the bugs started to circulate ahead of the planned release time. Then, according to the PHP Foundation, Chainguard "unilaterally broke the embargo," which "disregarded weeks of work by many parties toward a coordinated disclosure." PHP Foundation executive director Elizabeth Barron told POLITICO by email that while it was "disappointed" with Chainguard, it hopes to "rebuild trust with them in the future to ensure we can continue to collaborate effectively."

After the leak — which meant information about the bugs was in the open before the fix was ready — confusion quickly ensued, with government bodies and private companies choosing to temporarily shut down their websites rather than risk potentially damaging breaches to their data and the sites themselves.

Early Thursday, Matthew Prince, the CEO of Cloudflare, an internet services company widely used by websites to block cyberattacks, which gives it a high level of visibility into what hackers are doing, said in a post on X that it had seen "millions" of attempts to exploit the flaw.

Cloudflare saw thousands in the 10 hours before the flaw was publicly announced, then tens of thousands in the 45 minutes after the announcement, hundreds of thousands within two hours, and now millions, Prince said.

Amazon's cloud division also said the flaw is "now being broadly exploited in the wild."

One senior US government cyber official said that federal authorities have been overwhelmed — and not just by PHP. The same day the world was racing to address PHP, they were also dealing with bugs in node.js, a widely used JavaScript framework, Fortinet, GitHub and Oracle.

"The fire department is fighting multiple fires at once," the official said, adding: "The good news is they're all one-story structures on fire, which the fire department deals with all day, every day."

More to come

Dauntingly, OpenAI said there's more on the way. "These bugs are among several significant vulnerabilities we've already found and are working to fix, and we expect similar findings to increase sharply in the coming months," the company said Wednesday in a statement.

Matthijs van Amelsfort, head of the Dutch cybersecurity agency, said in an interview that the job of keeping computer systems safe has been transformed by the advancement of AI. "As soon as the frontier models came out, that's exactly what we said: This will be the trend," he said. "And actually that's happening now."

Thomas Caspers, vice president of Germany's cyber agency BSI, concurred: "We expect that [to be] happening more and more during the coming months."

AI also ramps up the risks once the flaws are out in the open. Cyber agencies' recommendation that organizations take their websites offline was "really a drastic measure," Caspers said. "We wouldn't have done that a few years ago or so." But because AI has made it quicker and easier to exploit flaws, "we had to do that," he said.

At the same time, the use of advanced AI to detect the flaws may create a new level of protection against malicious hackers looking to take advantage of them. Caspers said that though his German agency has also seen attacks, it has not seen any successful use of the flaw by hackers.

"It seems a little bit more complicated than expected to exploit," he said.

Despite the fact that AI offers a new way to discover flaws, the work involved in keeping systems protected is more quotidian, with cyber agencies urging organizations to install the fix shared by the PHP Foundation, in a process known as patching.

"There are three things that you have to do right now," said van Amelsfort from the Dutch agency. "And that's patch, patch, and patch."

John Sakellariadis contributed to this report.

The Axel Springer Global Reporters Network harnesses the resources of the company's newsrooms to publish ambitious scoops, investigations, interviews, opinion pieces and analysis. It allows journalists — including those from POLITICO, The Telegraph, Business Insider, WELT, BILD, Onet and Fakt — to collaborate on major stories for an international audience of hundreds of millions across platforms: online, print, TV and audio.

• Jen Eaves' mother is 79 and lost more than $3,000 to online scams.
• Eaves now monitors her mother's finances and says that was a hard conversation.
• Digital caregiving is an important part of supporting aging parents, she says.

This as-told-to essay is based on a conversation with Jen Eaves, Digital Caregiving & Elder Fraud Advocate at Aura. It has been edited for length and clarity.

It's an odd shift in dynamic when you start caring for the people who always cared for you. My mother is 79, and lives with my brother, who handles most of her day-to-day physical care. I'm the one who handles the administrative side of care, like scheduling doctor appointments and keeping her safe online.

About six years ago, my mom had a stroke, and while she recovered fairly well, she wasn't the same cognitively as she had been before. Around that time, I began noticing her falling for scams online.

Once, she ordered a cure for diabetes, which she has. The product was supposedly being sold by a famous TV doctor. When she showed me the video ad, I could see it was badly done AI, with the supposed doctor's lips not matching his words.

There have been other scams and pitfalls, too: online orders that never arrive, or even a legitimate credit card that my mom opened without realizing what she was doing. All in all, she's lost about $3,000 to scams, though I've been able to recover most of it through her bank.

I've realized that I need to take a more proactive approach to digital caregiving to protect my mom's finances. Here's what I'm doing.

Approaching from a place of help and dignity

After my brother and I had taken my mom's keys away, her phone became her connection to the world. I wanted to respect that. While some people have to restrict their older parents' access to phones, that didn't feel right in my case.

It was critical to me that my mom kept her dignity and as much independence as possible. At the same time, I saw there was an emotional side to falling for a scam: she would feel frustrated and confused when it happened, and I wanted to spare her those negative emotions.

I never want my mom to feel like I'm parenting her. Instead, I pointed out the patterns I was seeing and emphasized I'm here to help if she's willing to let me be involved. The choice, ultimately, is hers. This would be a lot harder if she wasn't willing.

Talk about scams

My mom wasn't particularly tech savvy, even before her stroke. I've had to educate her about what scams look like. When she shared the famous doctor video, I pointed out the aspects that seemed AI-generated to me. I remind her that if it sounds too good to be true, it probably is. I emphasize that urgency is a big sign of a scam. The bank, I tell her, is never going to call you.

Once, she had a scam caller claiming to be Apple support. They asked for her Apple ID and password, which would have given them access to pretty much everything she has online.

Because of our conversations, my mom hesitated. She patched me into the call and asked the scammer to explain the situation to me. I was very proud that she recognized the scam and knew to ask me for help.

I monitor my mom's accounts

I worked in cybersecurity at Aura, which offers a lot of great products for keeping kids safe online. But my experience with my mom made me realize we were missing a whole vulnerable population: older adults.

I helped develop Trusted Family Access, which allows family members like me to see alerts from their loved ones' accounts, with permission. This gives me peace of mind that I can catch any issues quickly. It's also made other aspects of caregiving easier, like handling medical appointments, because I have access to all my mom's information in one place.

When my mom was scammed, it felt like I was a victim too. I spent hours calling her bank and credit cards to get her money back. If she were to lose her savings, it would impact the whole family. I'm grateful we've found a solution that empowers both of us to keep her finances safe.

• Everyone complains about AI-generated junk.
• But decades of sloppy human-written software may be a much bigger problem.
• This week's "Black October" freakout was caused by human slop, not AI.

The internet has a slop problem. And for once, we can't blame AI.

Most of us spend hours online every day without thinking much about the software holding everything together. We assume somebody, somewhere, has made sure it all works properly.

So it probably came as a shock this week to discover just how vulnerable some of that software is.

The cybersecurity freakout dubbed "Black October" has inspired warnings about AI-powered hackers, digital catastrophe, and even advice to stockpile cash and canned food.

At first glance, AI looks like the villain. But this is largely a human-made mess.

Here's the problem.

The internet runs on decades of software, some of it containing security weaknesses that have been overlooked, tolerated, or simply left unfixed.

For years, that was a manageable gamble. Fixing software takes time and money. Exploiting obscure weaknesses often required considerable expertise. Companies could convince themselves that the risk wasn't worth worrying about.

AI is changing that calculation. Someone who once needed years of training to hunt for weaknesses can now get help from an AI model. These tools can also examine software at speeds that humans can't match.

Suddenly, all those problems we've been ignoring look more urgent.

"Over the last 10 years the risk acceptance process has morphed from a way to accept risks to enable the business, to a way to justify never fixing security issues," Joel de la Garza and Zane Lackey, partners at a16z, wrote on Friday.

That's quite an indictment. The result is a recent surge in published vulnerabilities.

This looks like AI is creating new security problems. But it's actually AI exposing weaknesses that humans left behind.

Slop irony

The irony is delicious. We've spent the past couple of years complaining about "AI slop." Turns out human slop can be pretty consequential, too.

"The funny thing is everyone was saying AI slop code will cause a cyber crisis but it's actually all the old human slop causing it and the AI is just cleaning it up," software engineer Ben Kaufman wrote on X on Thursday.

"Humans have been the ones writing and reviewing each other's code for decades," tech founder Anant Jain wrote on X. "If we're being intellectually honest and holding ourselves to the same bar we hold AI to, we'd have to admit that we haven't been all that good at it either."

Humans are sloppy

Anyone who's worked with other humans for a decade or two knows exactly how this happens.

It's Friday afternoon. You've almost finished a project. You could spend another few hours making it perfect, or declare it 90% done and head off to that dinner party. We've all been there.

AI agents don't have dinner parties. They don't get tired on Friday afternoons. They can keep searching, testing, and trying again. That persistence is now colliding with an internet built by busy, imperfect humans who often settled for "good enough for now."

A tragedy of the commons

There's another wrinkle here, though, and it's an important one.

Much of the software underpinning the internet is freely available for anyone to use. Some of it is maintained by volunteers or small groups of experts, even as enormous technology companies depend on it.

In 2020, the cartoonist Randall Munroe captured this absurdity in an xkcd comic. Modern digital infrastructure still rests precariously on tiny foundations.

It's funny because it's uncomfortably close to reality. Take the specific PHP problems from this week. These flaws have existed for years, and the PHP Foundation acknowledges that limited resources and disagreements over fixes contributed to delays in fixing them.

Tom Occhino, chief product officer at Vercel, brought up Munroe's cartoon during my recent interview with him.

He explained that AI is finding weaknesses even in software that the industry has treated as dependable for decades.

This is partly a version of the tragedy of the commons: Everyone benefits from a shared resource, but no one has sufficient incentive to take responsibility for maintaining it.

And let's be clear: The volunteers keeping essential software running aren't the villains here. The companies benefiting from their work have a much greater responsibility.

Occhino thinks AI could help solve the problem it is exposing.

He described an idea being discussed at Vercel: Create a foundation or coalition that funds efforts to identify vulnerable software and replace it with safer alternatives.

"We need a consortium. We need a coalition," he told me.

He suggested companies could contribute computing resources and AI tools to the effort. Nothing has been formally announced, but the idea is compelling.

Indeed, OpenAI's Patch the Planet effort is an example of what's possible.

Rather than simply using AI to create more software, the industry could use it to repair what already exists.

Occhino put it nicely: Companies need to spend less time chasing new ideas and more time asking how to make existing systems "just work really, really well."

That's a better response than panicking about the imminent collapse of the internet.

AI didn't create decades of neglected software. We did. Perhaps it's time to clean up our own slop.

Sign up for the AI Insider newsletter here. Reach out to me via email at abarr@businessinsider.com

• Mark Cuban compared swarms of AI agents to cockroaches finding ways into systems.
• Cuban said agents can launch brute-force attacks at scale without inventing new hacks.
• Cuban said defenders can also "spray" their systems with AI, which makes defenses more accessible.

Mark Cuban has pest-control tips for the AI age.

Speaking at a Reuters NEXT Newsmaker event on Friday, the entrepreneur and billionaire investor compared the threat posed by swarms of AI agents to cockroaches finding their way into a freshly treated house.

"When I go talk to cybersecurity experts, I ask them all the time. I'm like, when we hear about these hacks and breakthroughs and, you know, different problems, do these AIs invent something new?" Cuban said.

"No, they didn't invent something new," Cuban added. "But they're able to do something in mass volume that it's all brute force hacks."

Cuban compared the challenge to keeping cockroaches out of a house.

"It's like the cockroach theory, where if somebody can create enough agents, it'll find a way to get in, and then it just exploits that. But the good news is you can spray your systems with just as much AI, and I think there's gonna be more effort from the good guys trying to stop the bad guys," Cuban said. "I'm not a doomer at all."

The AI industry is already creating its own team of exterminators to contain risks.

OpenAI safety roles on LinkedIn jumped by 91% over the past year, spanning work such as system testing, technical research, and governance.

The risks have also surfaced during testing. Anthropic said that three Claude models accessed organizations’ live systems without permission after a third-party testing environment was misconfigured. The company subsequently introduced real-time classifiers to detect and block attempts to escape testing environments.

Cuban said AI could make malicious activity more accessible, but the same techniques could also strengthen defenses.

"There will be scenarios where bad stuff happens, but we've always had hacks," said Cuban. "And if it's brute force on that side with the bad guys, you can also use brute force with the good guys."

• PHP, the open-source computer programming language, had two major vulnerabilities exposed.
• Yonaton Keller woke on Wednesday to panicked messages about the two PHP vulnerabilities.
• He shares three steps you can take to protect your website.

This as-told-to essay is based on a conversation with Yonaton Keller, a 46-year-old product manager at Zafran Security, based in Tel Aviv. His words have been edited for length and clarity.

When I woke up at 6:30 a.m. on Wednesday, I had multiple messages from around 4:45 a.m. alerting me that two vulnerabilities in the PHP programming language had been disclosed.

I immediately understood that this was a very serious situation.

Websites run different versions of PHP, and it's estimated that around 70% of websites worldwide use it. This isn't the first time PHP vulnerabilities have been found, but these ones require essentially no authentication on the attacker's part.

It's a very tricky situation. If it were a year and a half ago, nobody would have really responded to this so urgently. But this might be one of the first major incidents of its kind in this AI era, and the cycle of how attackers operate and how we typically respond is broken.

AI enhances detection and response times, but it also means that any limited-technical person could exploit these vulnerabilities within minutes.

My team was very concerned and had to act fast

I'm based in Israel, so when it was 6:30 a.m., my time, it was the middle of the night in the US. This time gap worked in our team's favor, as we had time to figure out what was going on before our customers woke up.

PHP is an open-source computer programming language used to create websites and web applications. It's such a widely used programming language that we immediately understood that every one of our customers, which includes major corporations and businesses, would likely be affected by this.

With bugs or critical flaws in the infrastructure, like the two that were found in PHP, exploitation is actually quite easy, especially if you use AI agents. That was the first thing we understood: even completely unskilled attackers can use these vulnerabilities to take down sites.

The PHP Foundation said it would disclose the details of the vulnerabilities and release a fix for newer versions of the language around 5 p.m. Israel time. But some details had already been informally disclosed on an online forum. The post was deleted minutes afterward, but screenshots spread around the internet quite quickly in unofficial forums.

So, my team and I dropped everything else and spent all day on Wednesday gathering informal information to see whether we could mitigate the risk of exploitation before an official fix was released.

How to tell if you're at risk

The first step people can take to figure out if they're impacted is to look at their websites and web applications, and try to understand where PHP is involved. You can also assume that most, if not all, of them will use PHP in some way, unless you have very basic HTML-based pages.

The second step would be to look at what vulnerability scanners online are telling you. Tenable, Qualys, and Rapid7 are usually the big three for releasing detection rules and actually detecting the vulnerability. In this case, these vulnerabilities have caused such widespread panic worldwide that they were quick to respond. This is also a way to understand the exact vulnerabilities in your internet-facing assets.

After taking these steps, immediately look online to upgrade your website to the current PHP version. It's quite easy to upgrade that, and it's free. There are some technical steps to do after the fix, so you might need a tech guy to implement them. If you don't update your PHP version, the impact on your business and website can be very, very serious.

Some people are also fully taking their sites offline, and I think that can be the right call if you have evidence that you are being targeted. However, 70% of the internet can't and shouldn't be taken offline just because those sites have some vulnerabilities. It's an emergency step to take if you have evidence of potential exploitation, but it can't be a step taken by everyone.

This was not just about attackers disrupting your website or web application; it was about them taking control of your server, stealing sensitive documents, moving inside your network, and then carrying out malicious operations, such as deploying ransomware or other actions they intended.

The situation has calmed down, but my cybersecurity team is still very concerned

Things have calmed down a bit since Wednesday, but we're still very, very concerned. Patching 70% of worldwide websites doesn't take a minute or two.

Hours after the fix was disclosed by the PHP Foundation, there were already tons of exploitation attempts popping up online. Attackers are getting quicker. I think that in this AI era, when in a matter of minutes, many attackers can attack, you don't have the time you used to.

The whole traditional process of scoping the attack surface, establishing a remediation plan, then calling a guy who's going to be responsible for this remediation plan, et cetera, is broken.

For a long period of time, organizations were investing a lot in what we call post-compromise scenarios. I think the AI era of cybersecurity will involve a lot more security investments in the pre-compromise realm, so defenses can be pre-built and ready for attacks in situations like this.

The Greek Ministry of Defence plans to merge or close dozens of military units and facilities, while simultaneously establishing new commands for unmanned aerial vehicles (UAVs), space operations, and cyber warfare. This restructuring is estimated by authorities to save 530 million euros over five years. On Tuesday, Defence Minister Nikos Dendias presented the third phase […]

If you're reading this, then the internet still works. But that's something that we shouldn't necessarily take for granted after this week's global cybersecurity meltdown.

"Think of it this way: someone discovered that millions of buildings in the country have the same broken lock, and now everyone knows how to open it," writes Matt Shumer in a lengthy post on X about the situation. "The lock maker has sent out a fix, but every building owner has to install it themselves, and many haven't yet."

That massive vulnerability was identified with the help of AI, but the growing capabilities of AI-powered hackers mean that vulnerabilities can be exploited much more rapidly too.

This is the world we live in now. In August, more than 100 tech companies signed a letter warning about exactly this possibility. On Thursday, one of Anthropic's top information security officers wrote that cybersecurity threats "are going to get a lot worse before they get better." Major banks are rushing to secure themselves after reports of autonomous agents operating inside accounts (though many of them may have been authorized by account holders).

This is unlikely to be the last incident like this. Cybersecurity firm CrowdStrike says it saw twice as many "agentic intrusions" (hacking done by an autonomous or semiautonomous AI) in August as in July, and then the number doubled again in September.

Scary stuff, for sure. As is usually the case, however, prevention is better than panic.

Shumer's post contains many helpful suggestions for better online security—it is particularly important to secure your email accounts, since that is the gateway to so much of what we do online. Here's a 15-step plan to stay more digitally secure in the AI age. (And if you're really worried about everything falling to bits, Reason's got you covered there too.) If your devices and browsers have updates available, install them. And for the love of digital gods, don't click on random links in strange emails!

The man who (maybe) saved the internet? There is an old XKCD webcomic—and I'm dating myself as a very specific type of millennial by even referencing that—that seems to perfectly sum up what happened this week. Here it is:

Here's the craziest part: That's basically true! Except the one random person lives in Czechia instead of Nebraska. His name is Ondřej Surý, and The Atlantic's Charlie Warzel found him:

Surý, who lives in Czechia, does not work for the PHP Foundation. But alongside his day job as director of domain-name-system engineering at the nonprofit Internet Systems Consortium, in a volunteer capacity, he maintains and helps automate patches for the coding language. His work, with that of just a handful of others, has allowed countless websites and organizations to fix these vulnerabilities quickly. Over the past 48 hours, he's become arguably the unsung hero of the entire internet—despite the fact that the only compensation he receives is from modest donations. "Ondřej will save the internet today," a user in the PHP Subreddit wrote.

In the war between AI hackers and AI defenders, it's still humans who are the heroes. At least for now.

---

Art of the steal. Yesterday, in this space, I detailed how voters are fed up with the Trump administration's seemingly endless stream of corruption. But it's been a whole 24 hours, which means there is yet another scandal in the news—thanks to a Vanity Fair article about President Donald Trump's son-in-law Jared Kushner.

The article is an excerpt from a forthcoming book. In it, author Matthew Cole claims that Dutch investigators gained access to Kushner's phone with the help of Russian hackers. The evidence from the phone and other sources shows that Kushner has been taking money from the governments of Saudi Arabia and the United Arab Emirates to "push their agenda with Trump."

Kushner says the article's claims are "outrageous and categorically false."

But wait, there's yet another corruption story. The Justice Department is reportedly probing whether Trump ally Corey Lewandowski profited from his role as a top adviser at the Department of Homeland Security (DHS). The Washington Post reports that the investigation is based on a referral from the DHS inspector general and is focused on "contracting fraud."

It may or may not be connected to other allegations that surfaced in September, when The Wall Street Journal reported that Lewandowski approached officials in Qatar and the UAE about being hired to help with "visa issues" and other matters.

In both matters, Lewandowski has denied the allegations. He's no longer working for the department, having been fired earlier this year amid a messy scandal involving then–DHS Secretary Kristi Noem, who was also canned.

---

Scenes from Virginia: Federal prosecutors indicted state Sen. L. Louise Lucas (D–Portsmouth), one of the most powerful Democrats in Virginia, on charges of racketeering and money laundering in connection with illegal marijuana sales. (Don't get me started on how dumb it is that recreational marijuana use has been legal here since 2021, but commercial sales are still forbidden. If it's legal to use something, it should be legal to sell it!)

Lucas pushed the failed Virginia redistricting effort and has been an outspoken critic of Trump. She plans to fight the charges. Virginia Gov. Abigail Spanberger, also a Democrat, said in a statement that the timing of the indictment, just days before the midterm elections, "further erodes the trust the American people deserve to have in the Department of Justice."

---

QUICK HITS

• "The last thing José García-Sorto remembers after being shot in the chest is being pulled from his car, pinned to the pavement and handcuffed, his blood pooling around him on a Phoenix interstate. All he could think about was what would happen to his two young children if he died." The New York Times has a harrowing account of a Honduran immigrant who was shot by immigration officers last year. He's never been charged with a crime in connection with the incident, which suggests "the authorities did not find evidence that he had put anyone in danger."
• Phil Magness and David Hebert debunk the notion that tariffs can help "infant industries" grow and succeed in a global market.
• The Cato Institute's annual ranking of "Freedom in the 50 States" is out. Arizona takes the top spot. How did your state do?
• Is alchemy real now? A California company claims it has successfully turned mercury into gold.
• The World Series begins tonight, and it ought to be terrific. Despite low payrolls, Tampa Bay and Milwaukee were the top teams in their respective leagues this year. They are deep, talented teams full of characters worth cheering—Brewers' star pitcher Jacob Misiorowski is a huge Pokémon nerd; Rays' star hitter Yandy Diaz escaped from Cuba after being imprisoned there. And this is the first World Series since 1980 to match two franchises that have never won a championship.

The post The Man Who Saved the Internet appeared first on Reason Magazine.

CISA told organizations to take unpatched PHP systems offline as some Wikipedia and 4chan services went down

• Nick Woodhead said he went 48 hours without sleep while helping patch a major website vulnerability.
• The CTO said that with security problems piling up, October feels like "the month of hell" for tech.
• Because AI makes it easier to find and exploit security gaps, Woodhead expects more disruption.

This is an as-told-to essay based on a conversation with Nick Woodhead, founder of the AI company GPTree and chief technology officer at Rothco and Compubox. He spoke with Business Insider on Thursday to share how he's responded to vulnerabilities in the PHP programming language that could affect the majority of the world's websites. The following has been edited for brevity and clarity.

It's always a nightmare when these things happen. Since Tuesday evening, I haven't slept. It's coming close to 48 hours working on this. I'm a CTO, but I also run an agency for multiple clients and have my own company with my own product. So, balancing my time to get everything updated — it's just been exhausting.

About 70% of the internet runs on a programming language called PHP. I'm actively involved within the PHP community itself, so I did get a warning on Tuesday evening regarding the vulnerability and the fact that it was already being addressed by the PHP team. That gave me a head start.

I have some teams offshore, so I was able to jump on that with them.

It's not just applying the patches. It's making sure that nothing was already exposed. We already had infrastructure in place to easily deploy patches, but it still requires a good amount of manual involvement.

I knew that as soon as I walked into the office on Wednesday, I'd have to have my teams jump on this. They were already waiting for the patches to be released.

People are willing to help

One of the biggest headaches, especially on the client side, is that we have a lot of legacy systems, which are running on older versions of PHP that are no longer supported, and official patches are not going to be produced. For those, we ultimately had to come up with other plans. For example, taking sites temporarily offline or moving them behind VPNs.

Eventually, because it's an open-source community, those patches have already been backported, or implemented, by the community. So now we're shuffling back to some of those older systems to get them patched.

That's one of the nice things about PHP. There's such a vast community of people all willing to roll up their sleeves and jump in and help.

Even though I've been in leadership for the last 10 years, I've never taken my hand off the pulse in terms of being connected with the code and the infrastructure. So, I've been hands-on with the development and infrastructure teams to help make sure these issues are resolved. We've been reviewing logs and looking for any potential signatures of a breach that this vulnerability exposed.

The month of hell

It's also meant keeping up to speed with the latest news that's coming out and what other people are finding. We're in a position now where we feel comfortable and safe, but there are new vulnerabilities in the coding tool Node.js. We have some Node services, so now we're looking at how that potentially affects us. October just seems like the month of hell from a technology perspective.

I don't think there is an end in sight with the advancements in AI. For all the positives we get from it, there are a whole bunch of negatives, and this is a perfect example.

OpenAI has already stated that they found many more of these types of vulnerabilities that, thankfully, haven't been leaked. Over the coming months, they are either going to be patches or this information is going to get leaked in the same way and cause the same kind of panic.

I don't think we're at the end of the road yet. There's going to be a lot more to come.

• This week's cyber freakout explained: AI is making software weaknesses easier to find and exploit.
• The message from Cloudflare's Stephanie Cohen and Vercel's Tom Occhino: Don't panic!!!
• Do we need everything connected to the internet? Paper bank statements work well.

A few weeks ago, I heard a strange story about a friend who works at one of the Big Tech companies in Silicon Valley.

She'd recently ripped out the connected devices in her home, ordered paper bank statements, and stocked up on canned goods in her basement.

Now, she's a very sane, experienced person, and quite senior at one of the largest internet companies on earth. Why was she disconnecting so much? Just to be sure, my family ordered paper bank statements, too. It was still a head-scratcher, though.

Fast forward to this week, and her actions look a little less crazy.

AI models have exposed serious security weaknesses in software used by roughly 70% of websites. Meanwhile, US banks are finding AI agents inside customer accounts, including some that appear to be acting without their owners' instructions, Axios reported.

'Black October'

The digerati have now entered full freakout mode. Much of the internet meltdown is happening on, well, the internet, my colleague Alice Tecotzky noted.

On X and Reddit, warnings of a looming “Black October” spiraled into visions of AI grinding civilization to a halt. One lengthy post on X warned of a potential “global cyberattack/AI swarm” and offered a survival checklist: Stockpile cash in small bills, print out your neighbors' phone numbers, download maps, buy a hand-crank radio, and stash a gallon of water per person per day.

Oh, and don't forget the manual can opener. You don't want to survive the AI apocalypse only to be defeated by a tin of beans.

Nikita Bier, a prominent app developer and former head of product at X, best captured the mood.

"It's time to turn off the internet," he posted Wednesday night.

A Cloudflare exec says it's 'a little bit scary'

If you're reading this, you haven't done that yet. But should we really be worried?

I put that question to Stephanie Cohen, chief strategy officer at Cloudflare, which helps protect about 20% of the internet.

"The world is a little bit scary right now," she told me on the side of Cloudflare's annual conference in San Francisco this week.

Here's the problem. The internet is built on decades of software, much of it riddled with security holes.

Some of these weaknesses have been known for years. However, fixing them takes time and money, and hackers often lacked the skills to exploit them anyway. So they were left alone.

AI changes that calculation dramatically. Someone who previously needed years of training to break into a computer system can now get help from an AI model. And these tools can search for weaknesses at a speed humans simply can't match.

The result: The number of newly published software vulnerabilities (Common Vulnerabilities and Exposures in industry lingo) has exploded.

Now, there's a frantic race between people trying to break into systems and those trying to protect them.

Don't panic about AI

Cohen's message, though, was surprisingly reassuring.

AI helps the good guys find and fix these problems. Cloudflare, for instance, released protections for the latest vulnerability to customers, including those using its free service.

And there's a bigger effort underway.

OpenAI has launched an initiative called Patch the Planet, working with Cloudflare and other security professionals to use AI to find weaknesses in widely used software and help repair them.

Tom Occhino, chief product officer at Vercel, told me recently that his company has been talking with partners about launching a nonprofit that would fund a swarm of good AI agents that go out on the internet to find and fix software flaws.

Amazon is joining the fight, too. Its new Continuum service, available Thursday, uses AI agents to find security holes and propose fixes. Amazon said that people maintaining freely available software can use it to help protect the wider internet.

Humans may still have to check and approve these repairs, but the prospect of AI helping clean up decades of neglected software is encouraging.

The irony of this is not lost on some in the industry.

"The funny thing is everyone was saying AI slop code will cause a cyber crisis but it's actually all the old human slop causing it and the AI is just cleaning it up," software engineer Ben Kaufman wrote on X on Thursday.

Either way, Cloudflare's Cohen thinks these AI-inspired freakouts will push the industry to do better — by exposing issues and adding urgency to get them patched.

"We may end up in a world where actually we've become significantly more secure at the end," she said.

The trouble is getting there.

A fundamental question about the internet

When I ran into Occhino recently at a Vercel conference in San Francisco, he described a world in which software that everyone assumed was safe suddenly looks vulnerable because increasingly capable AI models are scrutinizing the basic systems that underpin the internet.

That led to a more fundamental discussion between us: Why did we connect so many things to the internet in the first place?

For years, the technology industry has raced to put everything online. Thermostats. Refrigerators. Doorbells. Cars. Bank accounts.

We assumed that connecting something to the internet automatically made it better.

Perhaps we should reconsider.

Before the internet

I remember the world before the internet. It worked pretty well. We managed to buy groceries, pay bills, heat our homes, and generally get through the day without every appliance talking to a computer somewhere.

That doesn't mean abandoning online banking or throwing your smartphone into the sea.

Occhino, for one, isn't particularly worried about hackers wiping out his bank account. Modern banks have sophisticated protections, and he recommends everyone turn on additional login security.

Maybe the cybersecurity crowd, which spends its life immersed in online threats, is missing something obvious.

Not everything needs to be connected.

Occhino put it neatly: "There's certain things that don't make sense to be on the internet in the first place."

Perhaps that's the lesson from this week's panic. We don't need to turn off the internet.

We just need to remember where the off switch is.

Alice Tecotzky contributed reporting.

Sign up for the AI Insider newsletter here. Reach out to me via email at abarr@businessinsider.com