Get a hand-crank radio, buy a camping stove, and stock up on water jugs. That’s what some online preppers are suggesting (opens in new tab) this week following the discovery of new cybersecurity vulnerabilities that have affected millions of websites globally.
News of the bugs in a programming language called PHP set off a wave of chaos in Silicon Valley and around the world Wednesday, as companies rushed to shore up their websites while hackers simultaneously tried to exploit them. Some governments took their sites offline (opens in new tab) in an attempt to avoid potential hacks as they worked to patch their systems. Other affected sites include (opens in new tab) Wikipedia, the Internet Archive, and many sites that run on the WordPress publishing platform. The language, whose vulnerabilities were discovered (opens in new tab) by researchers using popular AI models, is estimated (opens in new tab) to power roughly 70% of websites whose programming languages are known.
“As bad as things have gotten in the past 4 days, they are going to get a lot worse before they get better,” Jason Clinton, Anthropic’s deputy chief information security officer, wrote (opens in new tab) on X on Thursday, a day after the discovery of the PHP bugs was made public.
ADVERTISEMENT
It’s the start of what many expect to be a new era of cyber threats, where AI is able to find bugs that have existed quietly in software for more than a decade. The worst-case scenario, experts say, is if people can no longer rely on digital systems that have long been considered trustworthy, including bank accounts and essential infrastructure connected to the internet like water and energy. It’s creating a swell of paranoia among people outside of cybersecurity, who have little control over the systems they engage with every day.
Tom Morgan, who used to work on Wall Street and now writes a Substack about human consciousness, said he purchased a book on outdoor survival skills called “SAS Survival Handbook.” “If YouTube goes down, do you know how to tie a tourniquet?” he asked The Standard. “Do you know what berries you can eat and what berries you can’t?”
He hasn’t historically been much of a doomsday prepper, he said. But news of the latest cyberattacks have changed that. “Do I feel like a prepper today? Yes.”
On Thursday, Morgan purchased a Starlink Mini, which connects to the internet using satellites. He already owned a hand-crank radio, a solar-powered charger, an emergency “go bag,” and a month’s worth of ready-to-eat meals. He also shared (opens in new tab) on X a Claude-generated to-do list in the case of the entire internet going offline, which recommended getting access to an internet-free landline, downloading maps, and getting a manual can opener.
That he used AI to prepare for potential AI-related outages is of no consequence to him. “AI has really useful information,” he said. “I’m not training AGI by asking it how to prepare for the internet going down.”
“People feel helpless,” said Eva Galperin, director of cybersecurity at the Electronic Frontier Foundation, a nonprofit that champions digital privacy and free speech. “This is not an emergency in which most ordinary people have anything that they can do.”
That said, now is not the time to begin prepping for doomsday — at least over cybersecurity fears, she said: “I have water [stored] because I live in an earthquake zone, not because I think PHP is going to be a problem.”
In recent months, individuals outside of tech have been bombarded with news of AI-related mishaps. Over the summer, OpenAI agents hacked (opens in new tab) a company called Hugging Face, demonstrating a new level of AI capabilities without humans in control. Several (opens in new tab)AI labs (opens in new tab)revealed (opens in new tab) that their agents had also infiltrated companies they weren’t supposed to. Governments and universities have been impacted by hacks from the tech companies themselves, while bad actors increasingly try (opens in new tab) to use those agents for their own purposes. Tech workers keep saying AI will end humanity. Oh, and AI can soon hack your house.
That’s a product of the speed at which AI moves, said Ahmed Banafa, who teaches cybersecurity at San Jose State University. “We are used to technologies where it takes years to see some kind of incident,” he said.
He expects similar events will keep happening, frequently, until at least 2030. But they should not all be cause for concern. The PHP issues were actually showing how AI can find and help secure age-old issues so they can’t be exploited in the future, he said. “This is a positive one that’s meant to protect us, not like what happened with Hugging Face,” he said. “We have to ride this wave,” he added.
While security experts say it isn’t time to stockpile food and buy walkie talkies, Morgan says it doesn’t hurt. “Spending .0001% of your net worth and .00001% of your time prepping for this is the most sensible, rational thing ever,” he said. “It’s not doom-mongering.”
What security experts do recommend, though, is classic advice: stop using the same password for everything and turn on two-factor authentication. They are begging you.
