A cyber-storm watch nobody heard

Storm center raises alarm

The SANS Internet Storm Center raised its threat level last month for the first time since December two thousand twenty-one. It had done so only ten times since two thousand ten.

PHP2Shell hits 70% of websites

The main cause was PHP2Shell, a pair of vulnerabilities in PHP, the programming language behind about seventy percent of websites whose language is known. Attackers could take over web servers.

AI speeds up exploitation

AI can now derive from a patch what vulnerability it fixes and how to exploit it, work that once required intelligence services or elite hacking groups. Defenders have not kept up.

Patching lags far behind

Qualys counted one hundred sixty-seven million PHP installations on its customers' systems. Twelve hours after disclosure, about one in a thousand had been updated.

National outlets missed the story

In the eight days after PHP2Shell became public on October twenty, CNN, Fox News, NPR and USA Today published five thousand six hundred ten stories, and only nine mentioned it.

The Equifax lesson

In March two thousand seventeen, Apache patched a Struts vulnerability. Two months later, attackers used it to breach Equifax, which had not installed the patch, stealing data on one hundred forty-seven million Americans.

Vulnerability surge accelerates

A record five thousand four hundred sixty-one vulnerabilities were published in the week of October twelve alone, more than fifteen times the weekly average in two thousand twenty.

Congress must act on AI threat

The Congress that takes office in January will decide whether and how to pace the AI frontier, how much to spend on agencies that warn us, and who pays when unpatched servers expose customers.

“are going to get a lot worse before they get better”