You may have seen some pretty ominous headlines this week about "PHP vulnerabilities" and a wave of cyberattacks. Or maybe you (very understandably) scrolled right past them.

But here's what's going on, and why I think we should all be paying attention.

On Wednesday, two very serious security flaws were revealed in PHP, software that runs on roughly 70% of websites. These were essentially hidden holes that could allow hackers to break into websites, steal sensitive information, or even take control of them. Here's the scary part: word about the flaws leaked before the fixes were ready, and hackers were already trying to exploit them. Emergency fixes (called "patches") were released Wednesday, but there's no magic button that fixes the whole internet. Every affected website needs to be updated, either by its own team or its hosting provider. Cue a mad scramble, with governments and companies racing to protect their systems and some temporarily taking websites offline.

And, unfortunately, this isn't an isolated incident. It's been a doozy of a week for cybersecurity. If you want to dig deeper, here’s a decent rundown of what's unfolding.

But the bigger story IMHO is what this signals about the AI stage we're entering.

For decades, the internet has been built on software written and secured by humans, at human speed. And SO much of the technology we depend on is old, messy, and cobbled together with patches and workarounds.

Think about the systems that keep our electricity running, our water flowing, our money moving, and our government services working. We'd like to think they're all running on sophisticated technology, but if you've tried to pay a water bill or renew your driver's license lately, you know "state-of-the-art" isn't always the first phrase that comes to mind.

A couple of examples:

And then there's banking, where AI is creating a whole new set of headaches. Axios reported this week that major U.S. banks are detecting third-party AI agents accessing customer accounts, sometimes appearing to take actions beyond what customers actually asked them to do. Banks are scrambling to figure out how to tell the difference between what customers have authorized and what AI agents are doing on their own. 😳

Now imagine powerful AI tools combing through all this software, looking for weaknesses at a speed and scale we've never seen before. This could be fantastic when the good guys find the holes first. Not so fantastic when the bad guys do.

I think we're in for a pretty messy stretch of whack-a-mole as the world races to find, fix, and secure vulnerabilities. It's going to be disruptive. And honestly, probably a little scary.

Here's how I'm thinking about it.

Imagine we're living in a beautiful little dream house on the Gulf Coast, and hurricane season is just getting underway. Forecasters are warning that this one could be particularly rough.

We don't need to panic. But it's probably a good idea to check the shutters, figure out where we put the flashlights, and buy a few sandbags.

It's a little ironic that I'm writing a note urging everyone to be more cautious. I'm generally more of a risk-taker, spontaneous, figure-it-out-as-we-go kind of person. But in this case, I really do think it's worth spending some time getting our digital houses in order.

We can't personally fix the security holes in our banks, utilities, or the websites we use. But we CAN make it much harder for a hacker to turn one compromised account into access to our email, money, and personal information.

So, I put a little something together something to help: a Hard to Hack checklist

It's based on guidance from the Cybersecurity and Infrastructure Security Agency (CISA) and the FTC, with some additional precautions for the new world of AI-powered scams and attacks and what leading AI experts are advising..

It covers passwords, phones, home Wi-Fi, financial accounts, protecting our kids online, and more. It may seem like a lot 😅, but it's broken down by priority so you can start with the stuff that makes the biggest difference and then choose/do what matters most to you.

Here's the encouraging part: a lot of this comes down to pretty simple, boring things. Better passwords, software updates, extra security on our accounts, and having a family plan.

And also, the same AI that's helping hackers find weaknesses is ALSO helping security researchers find and fix them. There are some very smart people working hard to make our systems safer.

We can't control how all this unfolds, but we can make ourselves a lot less vulnerable.

My ask: Spend a little time this weekend knocking out a few things on the Hard to Hack checklist.

And if you open it and think WTF, I have no idea how to do half of this, I'm happy to help - just grab some time and I can walk you through it.

Please forward this to friends and the people in your family who still use the same password for everything. You know who they are.

See you next Friday,

Michaela

P.S. And, as always, please reply with any thoughts, feedback, or burning questions - I love hearing from you!