When the NSA Cyber account posts that there are “critical vulnerabilities” and that organizations should take systems offline until the threat can be mitigated, you kind of take them seriously on face value.

What followed was a warning to every organisation in America running PHP, the code behind around two-thirds of all websites,

“These vulnerabilities often provide a direct path to the server’s file system or database.”

The database is usually where a site keeps your name, your email and your login.

As such plenty of websites were offline and unavailable. Parts of Wikipedia went dark, along with 4chan, Pinboard and Something Awful.

In short, the entire internet seems to be under attack from someone… or should we say something.

This vulnerability isn’t something humans discovered, nor seem to be exploiting. This is AI discovered, and from what we can tell, malicious actors are using AI to exploit it.

What is PHP you ask?

It’s the code that builds web pages on a company’s computer. The bug is called PHP2Shell. It lets an attacker take over that computer without a password.

It can also trick the computer into coughing up its memory, which can include other people’s passwords. While the exploit exists, there is also a fix that came out this week too, what matters now is how fast organisations fix the problem.

The US is the most exposed country here. Estimates are as much as half the internet-facing computers running PHP are in the US.

Cloudflare’s boss, Matthew Prince, says his network saw thousands of tries at the hole in the 10 hours before it went public.

That hit hundreds of thousands within two hours of the announcement, and he puts it at millions now...

As this is happening, Axios reports that several banks are reporting that AI agents have found their way into customer accounts and were attempting to make unauthorised transactions.

Let’s be clear, these two things are not the same thing. But landing at the same time will confuse people that we’re under some kind of AI attack.

Not the case.

One (PHP) is a break in, but the exploit was first identified by AI (which is a good thing) and then patched.

The second (AI agents in banks) is customers letting agents into accounts and banks not being able to deal with it.

So no, we’re not under some kind of mass internet attack.

Yes, there’s a vulnerability, and there will be more identified by AI in the coming weeks and months. But ultimately, it’s AI that will help make the internet safer because it can find these exploits and then they can be fixed.

There will be reports of bad things happening, but none of it is going to trigger Skynet and Terminators to kill us all. The internet is not at risk.

So, should you stop banking online?

No. I haven’t seen a single big US bank report a problem, and Newsweek found no evidence any federal website was breached.

Big outfits have teams for this. Cloudflare (NYSE: NET) had shields up for its customers about nine hours before the flaw went public, and Automattic says WordPress.com was covered too.

The trouble is everyone else. Think of your kid’s Little League site, the county permit page or the plumber’s website, those who don’t have teams to cover OPSEC are at most risk.

Those are the sites that’ll get hacked over the next few months. One you trust could serve you malware, or a fake login page that looks like the real one...

What do you do?

The hole is on their computers, so there’s nothing for you to install.

But use some practical and well know security practices. Rotate passwords, make them complex, use 2FA everywhere you can.

Get to your bank or important services through its app or your own bookmark, never a link in an email or text.

Update your browser, phone and router this week. If a familiar site starts asking you to log in again, pushes a download or bounces you somewhere odd, close it.

I think the other thing this does is highlight the importance for cyber security companies. The like of Cloudflare (Nasdaq: NET) benefit from this because it’s their teams and their deployment of good AI that finds vulnerabilities and helps fix them so rogue AI or enemy states can’t attack them.

Not that long ago the market fear was that AI would make companies like Cloudflare redundant. But this week, we’ve seen they’re more important than ever before.

More soon,

Lewis Maguire