Matteo Wong writes:

This week could go down as the worst in the history of cybersecurity. On Wednesday, news emerged about two major vulnerabilities in PHP, a programming language used by 70 percent of websites, which prompted governments, hospitals, and companies around the world to take digital services offline as a precaution. There have already been millions of attempts to exploit these weaknesses.

But the PHP vulnerabilities were just the most attention-grabbing in a series of alarming revelations. Security flaws in, or successful hacks of, several major software products and platforms—including some used by Netflix, PayPal, Walmart, and other big names—were announced that same day. Yesterday, Quest Diagnostics, which runs lab tests for a third of American adults each year, disclosed that it, too, had been breached. When I asked Sam Rubin, a senior vice president at the cybersecurity firm Palo Alto Networks, about the potential fallout from yet another hack—this one of the cloud platform Railway, which is used by Intuit and MGM Resorts, among others—he paused. “I didn’t see that one,” Rubin said. “It’s been quite a busy week.”

Yet what’s most alarming about the past few days is that by next year, this stretch of incidents—which some security experts are calling “Black October”—may be remembered as normal, or even tame. “It’s going to feel like, over and over and over again, we’re finding more and more bugs in very critical pieces of software,” Matthew Prince, the CEO of the internet infrastructure and security company Cloudflare, told me. “This story, which feels unique and fresh right now—in a few months, it’s going to feel like we get one of these every week.” Prince said he knows of still more vulnerabilities that will be announced in the near future.

For the next year or two, if not longer, the internet is going to feel a bit touch and go, and more dangerous than we’ve come to expect. “It’s going to feel like the sky is falling” for a while, Prince said. There’s a decades-long backlog of bugs in software written without much review or scrutiny—which was more or less fine so long as there was a very small number of skilled hackers. Over the past two decades, companies, governments, and individuals have been lulled into a false sense of security: Most people don’t think twice about punching credit-card numbers into the website of a local restaurant or gift shop, or forking over a home address and phone number in just about any customer survey. But the internet was always a dangerous place. We’re just waking up from a trance.

AI agents can now be deployed as a cheap and near-infinite hacker army. In just the past couple of months, Rubin said, open-source models—which can be downloaded for free and used without restrictions—have become very good at finding vulnerabilities and automating attacks. In turn, the amount of malicious cyber activity has spiked. More websites will be defaced, more personal information will be stolen, and ransomware will proliferate. Rubin told me that the internet is entering a “valley of pain.” When I posed the concern that this is the new normal to Adam Meyers, a senior vice president at the cybersecurity company CrowdStrike, he told me, “I think it’s going to get a lot worse, actually.” [Continue reading…]