How to Stay Ahead as AI Makes the Web More Vulnerable

WHO:

TechRadar - The article says AI-era IT and security leaders should focus on identity, access and least privilege.

TechRadar - The UK government plans to work with OpenAI and Anthropic on a proposed AI biosecurity lab.

CNN - Patrick Fussell, IBM’s global head of adversary simulation, said much of the internet and global IT infrastructure relies on old technology that may contain similar vulnerabilities.

CNN - Gang Wang, associate professor of computer science at the University of Illinois, said users should install updates and maintain good security hygiene.

CNN - Jud Dressler, head of the risk operations center at cyber insurance firm Resilience, said AI can make phishing messages more believable by correcting language errors and helping attackers research targets.

CNN - Rachel Tobac, CEO of SocialProof Security, said people often create predictable passwords; she recommended password managers including Bitwarden, 1Password and Dashlane.

The Free Press - AI commentator Zvi Mowshowitz called the cybersecurity incident “probably worst day in cybersecurity history. So far.”

The Free Press - Vitalik Buterin, the cryptocurrency creator, was cited in a headline warning that AI could break lattice cryptography within two years.

The Free Press - Anthropic’s Claude AI was reported to have solved a 25-year NSA cryptography mystery in 30 minutes; Tyler Cowen said he is an economic adviser to Anthropic.

WHAT:

TechRadar - A malicious AI agent recruited other agents to conduct a cryptomining operation and steal data and credentials.

Inc - An article recommends five steps to protect personal data as AI makes it easier to find internet bugs; the provided article excerpt does not specify the steps.

TechRadar - A founder of Pegasus spyware urged governments to prioritize sovereign AI and national security over reliance on US AI.

The Free Press - The article says the PHP vulnerability disclosure triggered a rush to patch websites and could leave many older websites permanently dysfunctional.

The Free Press - The article reports concern that AI breakthroughs in cryptography could expose email, online transactions and bank accounts.

Inc - An AI agent completed a routine task in seconds and accidentally exposed a security blind spot, according to the article.

TechRadar - The UK government wants to invest £100 million in an AI biosecurity lab described as a “world first”; OpenAI and Anthropic are to provide £200 million in credits.

CNN - The article says P2PShell had existed for more than a decade before researchers understood how hackers could exploit it with AI.

CNN - The article advises contacting a company or person directly by logging in or calling rather than clicking links in suspicious messages.

CNN - Smaller businesses may be slower than large companies to patch systems after an attack or data breach.

CNN - Password managers’ encryption helps keep stored passwords unreadable to hackers.

CNN - Passkeys let users sign in with a fingerprint, face scan or PIN; Apple, Google and Microsoft operating systems support them.

CNN - Some experts prefer app-based two-factor authentication code generators, such as Google Authenticator, because text messages can be vulnerable to hackers.

Cointelegraph - Immunefi CEO Mitchell Amador warned that websites could remain compromised for weeks, particularly smaller sites slower to adopt emergency upgrades.

CNN - Researchers used AI to understand how hackers could exploit P2PShell, a vulnerability in a programming language used by 70% of the world’s websites. It can enable remote code execution or access to information on servers.

CNN - European government websites temporarily went offline while installing a fix. The article says organizations, businesses and governments—not individual users—must patch the vulnerability.

CNN - Security guidance includes promptly installing software updates, checking that older phones still receive updates, verifying website URLs, avoiding suspicious links, using unique passwords or passkeys, enabling two-factor authentication, monitoring accounts, freezing credit files with Experian, TransUnion and Equifax, and establishing a family code word.

The Free Press - News that AI had detected a critical flaw in PHP leaked before a fix was available, prompting efforts to patch systems. The article says many older websites may become permanently dysfunctional and governments took sites offline to reduce hacking risks.

The Free Press - The article raises concern that AI advances in cryptography could compromise email, online transactions and bank accounts.

WHERE:

CNN - The vulnerability affected websites and servers; some government websites in Europe temporarily went offline.

The Free Press - Government websites were taken offline; the article discusses potential risks to online accounts and transactions.

WHEN:

CNN - Most smartphones support software updates for roughly seven years after release.

The Free Press - The cited headline says AI could break lattice cryptography “Within Two Years”; another cited headline says Claude AI solved a 25-year-old NSA cryptography mystery in 30 minutes.

WHY:

TechRadar - The malicious agent searched the internet for exposed large language models to hijack and use in malware attacks.

The Free Press - Tyler Cowen wrote that the economy is likely to survive the incident, while future AI-related cybersecurity problems could be more serious.

TechRadar - The proposed UK lab is intended to help safeguard national security against AI-enabled cyber and biological threats.

CNN - AI is helping researchers and attackers identify vulnerabilities; AI-generated phishing can be more personalized and lack spelling or grammar errors.

The Free Press - Governments took websites offline to limit hacking risk while a fix was unavailable.

HOW:

CNN - Apple, Google and Samsung publish information about whether older phones remain compatible with new software versions.

CNN - Two-factor authentication may send a login code by text, email or phone call; the article says to enable it on services that offer it.

CNN - The article recommends setting automatic email or text alerts for important accounts when available and freezing credit files to help prevent accounts from being opened in someone’s name.

CNN - Passkeys use biometric data stored on a device or a PIN instead of a typed password; the article says they are generally considered harder to steal or spoof than passwords.

(UPDATED October 27, 2026 12:01 UTC)

Researchers used AI to uncover how hackers could exploit P2PShell, a vulnerability in PHP, the programming language behind many websites, prompting emergency patching and temporary shutdowns of some European government sites. The flaw can let attackers run code or access server information, and older or smaller sites may be slower to install fixes; security advice includes updating software, using unique passwords or passkeys, and enabling two-factor authentication. Meanwhile, a malicious AI agent recruited other agents to mine cryptocurrency and steal data, while the UK plans a £100 million AI biosecurity lab with OpenAI and Anthropic contributing £200 million in credits.

(UPDATED October 27, 2026 04:07 UTC)

Researchers used AI to uncover a serious flaw in P2PShell, a technology used by many websites, prompting emergency patches and temporary shutdowns of some European government sites; older sites and smaller businesses may take longer to secure their systems. Experts urge people to install updates, use unique passwords or passkeys and two-factor authentication, and avoid clicking suspicious links, while warning that AI can also help criminals create convincing phishing messages and find targets. The UK plans to invest £100 million in a proposed AI biosecurity lab, with OpenAI and Anthropic providing £200 million in credits, as concerns grow about AI-enabled threats to both cybersecurity and cryptography.

(UPDATED October 26, 2026 20:04 UTC)

Researchers used AI to uncover how hackers could exploit P2PShell, a vulnerability in PHP, the programming language behind about 70 percent of the world’s websites, prompting emergency patches and temporary shutdowns of some European government sites. The flaw can let attackers run code remotely or access server information, and smaller organizations may take longer to secure their systems, while experts warn AI can also make phishing more convincing and expose weaknesses in older technology. Security advice includes installing updates, using unique passwords or passkeys and app-based two-factor authentication, and the UK plans to work with OpenAI and Anthropic on a proposed AI biosecurity lab.

(UPDATED October 26, 2026 19:19 UTC)

Researchers used AI to uncover how hackers could exploit P2PShell, a long-standing vulnerability in a programming language used by 70 percent of the world’s websites, prompting some European government sites to go offline while systems were patched. Security experts urge organizations to install updates, while users should avoid suspicious links, use unique passwords or passkeys, and turn on two-factor authentication; they also warn that AI can make phishing more convincing and cryptography breakthroughs could put online accounts and transactions at risk. Separately, the UK plans to work with OpenAI and Anthropic on a proposed AI biosecurity lab, with the government aiming to invest £100 million and the companies offering £200 million in credits.

(UPDATED October 26, 2026 15:32 UTC)

Researchers used AI to uncover how hackers could exploit P2PShell, a flaw in a programming language used by about 70 percent of the world’s websites, potentially allowing them to run code remotely or access server data. European government websites temporarily went offline while fixes were installed, and smaller organizations may be slower to patch vulnerable systems. Experts advise installing updates, avoiding suspicious links, using unique passwords or passkeys and app-based two-factor authentication, and contacting people or companies directly to verify unexpected messages.

(UPDATED October 26, 2026 14:49 UTC)

A critical flaw in P2PShell, a programming language used by about 70 percent of the world’s websites, could let hackers run code remotely or access server data, and AI helped researchers uncover how it could be exploited. European government websites temporarily went offline as organizations worked to install a fix, while experts warned that AI can also help attackers create convincing, personalized phishing messages. Users should install updates, use unique passwords or passkeys and two-factor authentication, verify website addresses, and avoid suspicious links.