Welcome to the Valley of Pain
· The Atlantic
This week could go down as the worst in the history of cybersecurity. On Wednesday, news emerged about two major vulnerabilities in PHP, a programming language used by 70 percent of websites, which prompted governments, hospitals, and companies around the world to take digital services offline as a precaution. There have already been millions of attempts to exploit these weaknesses.
Visit catcrossgame.com for more information.
But the PHP vulnerabilities were just the most attention-grabbing in a series of alarming revelations. Security flaws in, or successful hacks of, several major software products and platforms—including some used by Netflix, PayPal, Walmart, and other big names—were announced that same day. Yesterday, Quest Diagnostics, which runs lab tests for a third of American adults each year, disclosed that it, too, had been breached. When I asked Sam Rubin, a senior vice president at the cybersecurity firm Palo Alto Networks, about the potential fallout from yet another hack—this one of the cloud platform Railway, which is used by Intuit and MGM Resorts, among others—he paused. “I didn’t see that one,” Rubin said. “It’s been quite a busy week.”
[Read: ‘If anything happens to this guy … everyone is screwed’]
Yet what’s most alarming about the past few days is that by next year, this stretch of incidents—which some security experts are calling “Black October”—may be remembered as normal, or even tame. “It’s going to feel like, over and over and over again, we’re finding more and more bugs in very critical pieces of software,” Matthew Prince, the CEO of the internet infrastructure and security company Cloudflare, told me. “This story, which feels unique and fresh right now—in a few months, it’s going to feel like we get one of these every week.” Prince said he knows of still more vulnerabilities that will be announced in the near future.
For the next year or two, if not longer, the internet is going to feel a bit touch and go, and more dangerous than we’ve come to expect. “It’s going to feel like the sky is falling” for a while, Prince said. There’s a decades-long backlog of bugs in software written without much review or scrutiny—which was more or less fine so long as there was a very small number of skilled hackers. Over the past two decades, companies, governments, and individuals have been lulled into a false sense of security: Most people don’t think twice about punching credit-card numbers into the website of a local restaurant or gift shop, or forking over a home address and phone number in just about any customer survey. But the internet was always a dangerous place. We’re just waking up from a trance.
AI agents can now be deployed as a cheap and near-infinite hacker army. In just the past couple of months, Rubin said, open-source models—which can be downloaded for free and used without restrictions—have become very good at finding vulnerabilities and automating attacks. In turn, the amount of malicious cyber activity has spiked. More websites will be defaced, more personal information will be stolen, and ransomware will proliferate. Rubin told me that the internet is entering a “valley of pain.” When I posed the concern that this is the new normal to Adam Meyers, a senior vice president at the cybersecurity company CrowdStrike, he told me, “I think it’s going to get a lot worse, actually.”
Consider, for instance, another set of vulnerabilities disclosed this week, to the program Node.js. This software, which executes JavaScript code for dynamic webpages, is widely used by Fortune 500 companies, as well as in programs developed with AI. “These are the things the web runs on,” Meyers said. Because of how the platform is used, compromising just one software product that uses Node.js could infect tens of thousands of other organizations, Rubin said, in what is known as a “supply-chain attack.” And the skill threshold for launching cyberattacks has become almost absurdly low: CrowdStrike tied a spate of cyberattacks on South Korean banks late last month to a 26-year-old in China. “After he got access to all the data, he turned around and asked AI, ‘How do I monetize this? Where can I sell this?’” Meyers told me. He “didn’t know what he was doing.” Meyers said CrowdStrike is detecting “a new agentic adversary”—that is, an AI-powered hacking operation—“every two hours.”
Navigating this will require rapid and tremendous coordination from basically every sector. For instance, the vulnerabilities in PHP were discovered months ago by a consortium of AI and cybersecurity firms. Then, “very quietly, for the last several months, we and other industry partners worked to effectively put in place protections,” Prince said—basically, temporary shields until the weaknesses could be fully addressed. But “not everybody uses CloudFlare, and not everybody is quick to patch their software.” Some of the cybersecurity experts I’ve spoken with are optimistic about AI: Eventually, they say, AI will be used to find and address many of the major cybersecurity flaws, and the internet will become much safer overall. But before then, we may be stuck in a terrible limbo. “This is going to last as long as it takes to rewrite and secure the billions of lines of code that have always had these vulnerabilities,” Alex Stamos, the chief information-security officer at the AI company Cognition and a former chief security officer at Facebook, told me.
And even as cybersecurity experts rush to leverage AI to save the internet, the technology is introducing plenty of new problems. All vibe-coded apps, for starters, are very likely to contain security flaws. And at a time when people need to be more vigilant about their digital hygiene, multiple cybersecurity experts brought up the widespread adoption of AI assistants with more than a hint of scorn; as Rubin put it: “Our peers are using Muse and giving it carte blanche to use your credit card.”
The internet is becoming a wilder place, and the path to secure it may require, in essence, a sort of pruning. “You’ll likely see more companies take services off the internet when they don’t need to be there,” depreciating old webpages and forms so they can’t be targeted, Dan Guido, the CEO of the cybersecurity firm Trail of Bits, told me. Individuals might be encouraged to delete unused browser extensions, he added, so that there are “fewer pieces of software that can access your data.” People in general need to be “more discerning of the companies they work with,” Stamos said, and “you’re just not gonna be able to assume every site you use is secure.” That Pokémon trading-card website, fantasy-sports platform, or birding forum you use could be hacked for a password you’ve reused elsewhere, or a credit-card number, or worse. Other advice I heard: Don’t host your own email client instead of Gmail. Don’t host your own file system at home instead of using the cloud. Google and Dropbox have the resources to defend against an onslaught of AI hacks, and you don’t.
If, eventually, we do find and shore up all of the cybersecurity vulnerabilities out there, the result could be a more open web, where anybody can use widely available AI tools to run security checks at any time and you’ll feel safer sharing your personal information again. But another possibility is an even more centralized internet, where only services and websites developed by large software providers are deemed trustworthy and reliable. The internet needs new walls to defend against AI-powered attacks. But in turn, we might also feel walled in.