AI is exposing how fragile the web really is. What you can do to stay safe

The vulnerabilities were around for years — more than a decade — but researchers were only able to understand how hackers could take advantage of them with the help of AI. The vulnerability, called P2PShell, impacts a coding language that powers 70% of the world’s websites, enabling hackers to remotely execute code or gain access to information stored on servers. That sent websites into a scramble to update their systems, with some government websites in Europe going offline temporarily this past week until they could install the fix. The discovery is yet another reminder of the fragile infrastructure of the internet. And with AI supercharging the abilities of both researchers and bad actors to discover flaws, it likely won’t be the last time a discovery like this is made. “A lot of the internet and a lot of global IT infrastructure runs on technology that’s quite old, or is based on things that are very old in terms of computers, and likely have similar vulnerabilities,” said Patrick Fussell, IBM’s global head of adversary simulation. With a vulnerability like P2PShell, there isn’t much that users can do to protect themselves. It’s up to organizations, businesses and governments to update their services with the latest security patches. But it does underscore the importance of being smart about your digital habits. The age-old advice of keeping your passwords secure and being wary of suspicious emails is more important than ever as hackers gain more sophisticated tools and use AI to find more of the internet’s weak points. Update your software Don’t ignore those software update notifications on your laptop or phone. Many of these updates include critical security fixes, and installing them as quickly as possible shortens the amount of time hackers have to take advantage of bugs. “Users still need to do their parts in terms of installing those updates and maintaining a good security hygiene to put them in a slightly better position,” said Gang Wang, associate professor of computer science at the University of Illinois. Most smartphones now support software updates for roughly seven years following their release. If you have an older phone, you should check if it’s still compatible with new software versions. You can find information about software compatibility on Apple, Google and Samsung’s websites. Watch out for phishing attacks Pay attention to the URLs of websites you’re visiting and links you’re clicking, especially if you’ve received the link in an email or text claiming to be your bank or credit card company. Never share personal data, email addresses, passwords, banking information or credit card numbers unless you’re certain the website is legitimate. AI has enabled attackers to create sophisticated phishing attacks that are more difficult to spot and may lack the key red flags of a scam. “The traditional way of determining a phishing attack was, ‘Hey, it didn’t sound right. It used wrong language. It had spelling errors, grammar errors,’” Jud Dressler, head of the risk operations center at cyber insurance firm Resilience, previously told CNN. “All of that stuff, the AI is going to take care of that.” AI can also help attackers conduct deeper research on potential targets to create more personalized and convincing messages, Dressler added. The best way to avoid phishing scams is to log into your account or call the company or person you’ve received a suspicious message from, rather than clicking links. Also, remember that smaller businesses may be slower to patch their systems in the event of an attack or data breach compared to large companies. Brush up on your passwords Never reuse passwords. Instead, try a password manager that creates long, unique passwords for all your online accounts. Simply put: Computers are better than humans at making passwords that are hard to guess. “We know humans, when they make decisions, they tend to make the same decisions as other people,” Rachel Tobac, CEO of cybersecurity and training company SocialProof Security, told CNN’s Terms of Service podcast with Clare Duffy in 2024. “So, you know, they make a password for their work. It has the work’s name in it. It’s got a capital letter in the first position to satisfy the capitalization requirement.” Tobac recommended password managers like Bitwarden, 1Password and Dashlane. The most important thing to look for is whether a password manager offers encryption, which keeps your passwords safe and unreadable to hackers. Other tips for staying safe online Use passkeys instead of passwords: Passkeys are digital credentials that let you sign into online services using your fingerprint, face scan or PIN instead of a typed password. Passkeys are generally thought to be more secure than passwords since they’re tied to biometric data stored on your device that can’t be as easily stolen or spoofed. Apple, Google and Microsoft’s operating systems all support passkeys. Use two-factor authentication: Enable two-factor verification on any service that offers it. Two-factor authentication sends a login code via text, email or phone call as an extra layer of protection in addition to your password. Some experts prefer app-based code generators like Google Authenticator since text messages can be vulnerable to hackers. Monitor all your important accounts: Keep an eye on all important accounts for suspicious changes. Many offer automatic email or text alerts. Freeze your credit report: Freezing your credit file with the three main agencies — Experian, Transunion and Equifax — is an easy way to prevent nefarious actors from trying to open new accounts in your name. Create a family code word: If you get a suspicious call or message from someone who sounds like a loved one asking for information, call them back yourself, or call people close to them if you can’t get a hold of them. A code word shared between you and your loved ones can confirm their identity. While AI is making it easier for even novice hackers to execute more advanced campaigns, bad actors are still trying to take advantage of humans at the end of the day. “It’s still kind of a familiar attack method,” said Dressler. “It’s just using essentially AI to make it more believable and more effective.” By Lisa Eadicicco, Hadas Gold

72 Percent of Executives Say Companies Aren’t Really Transforming Work With AI. It Shows Why Increasing Productivity Isn’t Enough

Companies are using AI to help employees accomplish more. New research suggests the bigger opportunity is changing what organizations can accomplish together. Companies are investing billions in artificial intelligence to make employees more productive. Reports can be written faster, information can be analyzed in seconds, and routine administrative work can be automated. By conventional measures, those improvements represent progress. But new research from SAP SuccessFactors suggests that many organizations may be pursuing the wrong objective. They are becoming better at completing existing work without fundamentally reconsidering how that work creates value. The research published October 7 by SAP’s Future of Work Research Lab draws on global research involving 2,718 employees, 500 C-suite leaders, and 60 HR executives, among other sources. One finding is particularly revealing: 72 percent of C-suite leaders believe that most organizations claiming to transform work with AI are actually automating existing jobs faster. That distinction exposes a problem. An organization can become more productive without becoming more effective. Productivity and performance are different things Productivity measures the relationship between inputs and outputs. How many reports can an analyst produce? How many customer inquiries can an employee resolve? How many hours can a company eliminate from an administrative process? These are useful measures, but they reveal only part of organizational performance. Consider a company that uses AI to double the number of market analyses its employees produce. The productivity improvement is measurable. But if those analyses continue moving through the same approval processes, reaching the same decision makers, and informing the same strategic assumptions, the organization may not become any better at responding to its market. More information does not necessarily produce better decisions. Faster work does not automatically produce greater adaptability. Research from McKinsey reinforces this distinction. Its global study of how organizations are capturing value from AI found that, among 25 organizational practices examined, redesigning workflows had the greatest effect on whether companies reported an earnings impact from generative AI. In other words, the value of technology depends partly on what organizations change around it. SAP’s research points toward a different operating model The SAP researchers identified six shifts that could make work more valuable and engaging. They include moving from static jobs to dynamic roles, from centralized authority to decentralized decisions, and from measuring output to measuring impact. In an experimental study conducted by SAP SuccessFactors researchers, employees reported 77 percent greater perceived autonomy under decentralized decision-making, while dynamic roles were perceived as 49 percent more challenging than static jobs. These findings concern employees’ perceptions of work design, not demonstrated improvements in business performance. Nevertheless, they suggest that changing how work is organized could improve the conditions under which people contribute. When employees have greater authority to make decisions, they can respond to problems without waiting for unnecessary approval. When roles become more flexible, expertise can move across organizational boundaries. When performance is evaluated by impact rather than activity, employees have stronger reasons to concentrate on outcomes that matter. These changes do not simply make existing work faster. They change how an organization functions. AI can increase output without increasing capacity Greater productivity can also create unexpected demands on employees. Researchers Aruna Ranganathan and Xingqi Maggie Ye examined how generative AI changed work habits during an eight-month study at a technology company. In their research published in Harvard Business Review, they found that employees worked faster, assumed additional responsibilities, and extended work into more hours of the day, often voluntarily. AI made more work possible, but that did not necessarily make work more sustainable. The distinction matters because every additional output can create new demands for coordination, review, and decision-making. A company generating twice as many analyses may also create twice as many recommendations for someone to evaluate. SAP’s research identified a related problem. Although 88 percent of employees reported changes to their jobs because of AI, half of those changes occurred without meaningful guidance from managers or their organizations. Employees are adapting to new capabilities while the systems around them remain largely unchanged. Technology increases what individuals can accomplish, but organizational friction can prevent that capability from producing greater value. Measure what the organization can accomplish together Leaders should begin by asking three questions that traditional productivity measures often overlook: Are decisions improving? Does relevant expertise reach decision makers sooner, and can teams respond more effectively to emerging problems? Is coordination improving? Can employees combine their knowledge, share responsibility, and work across functions without unnecessary barriers? Is the organization becoming more adaptable? When customers, technologies, or competitive conditions change, can people reorganize their efforts and respond effectively? These measures are harder to capture than hours saved or tasks completed. They are also closer to what determines sustained organizational performance. The larger opportunity presented by AI is not simply to accelerate individual work. It is to improve the relationships, responsibilities, and decision processes through which people create value together. Making everyone more productive may improve today’s numbers. Making the organization more capable can change tomorrow’s possibilities. EXPERT OPINION BY SCOTT HUTCHESON, AUTHOR, BIOHACKING LEADERSHIP

Websites shut down globally after AI finds cybersecurity flaw affecting 70% of the internet

Governments and companies around the world are racing to fix vulnerabilities revealed by artificial intelligence that could affect 70% of the world’s websites. Some websites and services briefly went dark after the set of vulnerabilities were announced Wednesday. The US National Security Agency and Europe’s cybersecurity agency advised companies to take immediate action to address two critical flaws in PHP, a programming language that powers 70% of the world’s websites. The flaws in PHP were uncovered and addressed by teams at OpenAI, Google-owned cybersecurity company Wiz, and another cybersecurity company, Calif. The underlying flaws had existed for a decade, but exploiting them involved a complex set of steps “at the edge of what human researchers could practically achieve,” according to Wiz. Researchers then deployed AI to adapt techniques for taking advantage of those vulnerabilities – known as as “exploits” in cybersecurity – and analyze the results. The bugs, collectively called PHP2Shell, could allow attackers to break into websites and read memory that could contain sensitive information, like passwords. The PHP Foundation, the organization behind the coding language, has released a patch for the bugs, which have been hidden in their software for years, and is urging website operators to update their systems immediately. The CEO of Cloudflare said on X that his company’s network has observed millions of attempts to exploit the vulnerabilities in the past couple of days. “With PHP behind such a vast share of the web, the exposure could reach almost everywhere people spend money online,” said Nigel Green, the CEO of deVere Group, a financial advisory firm. “Booking platforms, marketplaces, subscription services, ticketing sites, delivery apps and utility portals could all be holding card details on systems built with the same kind of code,” he added. ‘AI inflection point’ The vulnerabilities involve an issue with how the PHP language works with a computer’s memory. When a website request unexpectedly ends, PHP could leave data behind in the memory that can be accessed and potentially corrupted or exposed later. The flaws could allow attackers to remotely execute code, disrupt services and expose customer data, according to web infrastructure provider Cloudflare, which has been working with the PHP Foundation, Calif, OpenAI and Wiz to address the issue. “Think of a hotel room where you check out, but your key still works,” Patrick Fussell, global head of adversary simulation at IBM, told CNN. “And so you can just go back into that hotel room later, and now somebody else’s stuff is there.” The bugs were discovered in late August but were disclosed to the public only on Wednesday, after PHP had come up with a fix. AI played a crucial role in identifying and fixing vulnerabilities “that had remained hidden in the PHP codebase for more than a decade,” according to Wiz. The company called PHP the “backbone of the web” and said the episode marks an AI inflection point. “What AI changed was the ability to understand the weaknesses,” Wiz researchers wrote in a blog post Wednesday, and then quickly exploit those weaknesses into a way to attack. “With frontier AI models and the right tools, a single researcher completed in a week what previously would have taken a world-class team months of work,” they added. Researchers at Wiz used Google’s Gemini 4 Argon, Wiz Atlas and OpenAI’s GPT-5.6 Sol during the research process. World leaders weigh in Global leaders urged organizations to take action. Dutch Prime Minister Rob Jetten said that his cabinet was “closely monitoring the situation surrounding the vulnerabilities in PHP.” Japan’s Prime Minister Sanae Takaichi said companies should consider suspending services if necessary in order to reduce their exposure. “Please check if your publicly available websites use PHP, and prepare to apply the fix patch that will be released tonight… as soon as possible,” she posted on X Wednesday. Japanese airline ANA, railway operator JR West and the country’s largest bank, MUFG, were among companies that reported some webpages and services temporarily suspended. In Europe, government websites in France, Denmark, Finland and the Netherlands, including the Dutch cyber security agency, were temporarily taken offline while security fixes were implemented. The Wikimedia Foundation, the non-profit that operates Wikipedia, told CNN Thursday that it was “in the process of addressing security vulnerabilities in PHP,” and that a number of its systems had been taken down as a “precautionary measure.” Nearly three dozen UK government services are unavailable and four are “partially unavailable” while security upgrades take place, UK government minister Elizabeth Lloyd told the House of Lords Thursday. The Journal, Ireland’s second most-popular news outlet, was temporarily offline Thursday morning while it bolstered its “defences,” it said in a notice. A shift in cybersecurity Wiz researchers say the issue is on par with the Heartbleed bug from 2014, which impacted an encryption technology estimated to be used by some two-thirds of the Web. Heartbleed allowed cybercriminals to access data that should have been protected. Like Heartbleed, the researchers at Wiz say PHP2Shell could similarly serve as a turning point in cybersecurity. While the vulnerabilities existed for years, AI made it practical to deploy them. “The speed with which vulnerabilities are being discovered is well beyond what it ever was before,” said Fussell. Even though a patch has been released, it’s likely that not all companies and organizations will update their systems at the same time, according to Gang Wang, associate professor of computer science at the University of Illinois. That could give bad actors a window to exploit it now that the vulnerability has been made public – and they can now do so faster using AI. But taking advantage of the vulnerability is no easy task, even with the help of AI, according to Fussell. “This is being touted as like, ‘Hey, you can push a button and basically take over a server type of thing,’” he said. “…To actually pull this off requires a couple of conditions that are actually fairly complex and not always going to work out in favor of somebody who’s trying to go and exploit this bug.” By Lisa Eadicicco, Hanna Ziady

AI Agents Are Breaking the Internet. 5 Things You Should Do Right Now to Protect Yourself

A thing we’re learning more and more is that much of the internet runs on technology that’s been around for decades. Sure, the websites and apps we use every day look very different from what they did 20 years ago, but a lot of the underlying infrastructure hasn’t actually changed that much at all. And, as it turns out, a lot of that infrastructure is more fragile than you might think. Last week was a pretty good reminder. First, researchers disclosed two critical vulnerabilities in PHP, the programming language that powers roughly 70 percent of websites. According to experts, the flaws could allow attackers to take complete control of vulnerable servers without even needing a password. AI played an important role in identifying and validating the vulnerabilities. That’s great, but the same technology that finds bugs can also be used by people trying to exploit them faster than companies can fix them. Then, security researchers disclosed that they had discovered compromised encryption keys belonging to an Indian company responsible for issuing TLS certificates. Those certificates help browsers know that the sites they connect to are actually what they say they are. So, when you visit the URL for your bank, you’re actually giving your login and password to your bank, not some phishing scam. The problem is, the encryption keys were based on a single digit, not a 256-bit key. Anyone with those keys could impersonate almost any website, at least until browsers stopped trusting the affected certificates. To be clear, there’s not much you can do personally about vulnerabilities in PHP or compromised security certificates. There are, however, a handful of relatively simple things everyone should do right now to protect their information. 1. Use a password manager Everyone hates remembering passwords, which is why far too many people use the same simple password for all kinds of websites. That’s a huge problem, and using a password manager that can safely store unique passwords is probably the single most important thing you can do to protect your information online. A password manager creates a unique, hard-to-remember password for every account and then remembers it so you don’t have to. That means if one website gets hacked, criminals can’t simply use that same password to access your email, bank, or other accounts. Apple’s Passwords app and Google’s Password Manager are built into their respective platforms. There are also excellent options like 1Password that make it easy to share access to login credentials across families or teams. Even better, use passkeys whenever they’re available. I realize a lot of people resist passkeys because they don’t understand, but they’re far easier to use than passwords and virtually impossible to steal through phishing. 2. Turn on two-factor authentication Even strong passwords aren’t entirely secure. If someone does get your password, they have access to your account unless you turn on two-factor authentication (2FA). You’re probably most familiar with entering six-digit codes via text message after you log into a website. That’s 2FA. The whole point is that your password isn’t enough—you have to have access to a second factor to gain access to the account or website. You can also use an authenticator app, but receiving a code by text message is better than having no protection at all. At a minimum, you should definitely enable it for your email and Apple Account. Your email is the way someone could reset passwords for everything else, and your Apple (or Google) Account has pretty much all your personal information and photos. 3. Pay attention to which apps have access to your information As AI agents become more common, a lot of people are connecting them to their Gmail, cloud storage, and other sources of data. That’s super useful, but you’ve basically given your AI tool permission to access information you probably would prefer be kept private. Depending on the permissions you enable, your AI agent might even be able to modify files, send messages, or take other actions on your behalf. That’s incredibly useful, but it also means that there is a risk. It’s worth taking a few minutes to check all of the applications connected to your most important accounts. Turn off anything you don’t recognize or don’t use anymore. And don’t give an AI agent permission to do something it doesn’t actually need to do. 4. Turn on automatic updates I get it, software updates are annoying. I don’t know anyone who enjoys updating their computer or iPhone, especially since it seems that the only time either wants to update its software is when I sit down to do something important. Still, making sure you are up-to-date is one of the easiest ways to protect yourself. Security issues are constantly being discovered, and software updates are how companies fix vulnerabilities. In fact, the PHP flaws disclosed last week are a perfect example of why keeping software updated matters. Make sure your phone, computer, and browser install security updates automatically. It might be the simplest thing that can protect you without requiring you to think about it again. 5. Be skeptical of anything asking for your information AI has pretty much removed all friction when it comes to creating convincing emails, text messages, and even phone calls that appear to come from someone you know and trust. Partly that’s because its good at looking at real human writing and producing reasonable messages that sound like they’re actually coming from another person. As a general rule, you should never click on unexpected links asking you to sign in or provide financial information. If you do get an email that you think is real, open the company’s app or website directly. And if you’re using an AI agent, require your approval before it sends messages, makes purchases, or changes important information. Obviously, none of these things are going to make you completely immune to sophisticated attacks. That’s especially true when many of the most critical issues are in software and systems you don’t have any control over. But these five steps are things you can control, and that’s the point. As AI agents become more capable, the internet is going to become an increasingly complicated place to keep information secure. There’s not a lot you can do about that, but the good news is that there are little things you can do that go a long way toward keeping your information safe. EXPERT OPINION BY JASON ATEN, TECH COLUMNIST @JASONATEN