A cyber-storm watch went out last month, and almost nobody reported it

In October of last year, the SANS Internet Storm Center raised its threat level for the first time since 2021, with only 10 instances since 2010. Finland took government websites offline, and the Dutch parliament's site went dark. Experts urged organizations to take offline any systems they couldn't fix immediately. Despite these warnings, many people remained unaware of the situation.

As a cybersecurity reporter, I decided to cover it, abandoning my planned lecture topic. The main cause was PHP2Shell, a pair of vulnerabilities in PHP, the programming language behind roughly 70% of internet sites. These flaws, existing since at least 2012, allowed attackers to take over web servers. PHP's maintainers released a patch on October 21, but attacks had already begun.

Despite this, only one in a thousand had updated their servers within twelve hours of the disclosure. AI can now derive from a patch what vulnerability it fixes and how to exploit it, a task previously reserved for intelligence services or elite hacking groups. Defenders have fallen behind, with only twelve percent of installations patched within a week.

AI can also write exploits for vulnerabilities, as demonstrated by Anthropic's Claude model seizing control of Linux servers through a recently discovered Linux vulnerability. Despite the severity, national news outlets largely ignored these vulnerabilities. Over a week, only nine stories mentioned them out of 5,610 published by major outlets.

This lack of coverage mirrors how hurricanes are reported - destruction is highlighted, but not the forecast. The public needs a hurricane watch for these cyber threats, with clear warnings issued by agencies like CISA. National outlets should cover these warnings, similar to how they report on product recalls. Congress, AI companies, and the public must all play a role in addressing this growing issue.