The Internet Is Under Attack. What Should You Actually Do?

Skip the doomsday bunker. Do these 6 things instead.

The worst 48 hours in cybersecurity history.

“Black October” had already seen a rash of attacks. Hackers exposed patient records at Quest Diagnostics and data on millions of California public school students. They even overheated refrigerators in French grocery stores.

Then last Wednesday, details leaked about two bugs in PHP, the software behind 70% of the internet’s websites. The bugs can let anyone take over a website’s server without a password.

Within hours, hacking attempts surged into the millions. Governments across Europe shut down websites, and the NSA urged organizations to take systems offline if they couldn’t be patched immediately. The UK government told Britons to stockpile food and water for cyberattacks and other emergencies.

Between Y2K and data breaches at Target and Equifax, we’ve become accustomed to cyber scares. Some fade away, but others are painful. In July 2024, a faulty CrowdStrike update crashed Windows computers and canceled summer vacation flights across America.

Should we keep calm and carry on, or stock up on beef jerky and canned green beans?

Why now?

Two things, both AI-related:

First, AI has gotten scary good at finding software vulnerabilities. The PHP bugs had existed for over a decade without being noticed. Thanks largely to AI, researchers found four times as many critical bugs this October as last October.

Second, AI lets attackers probe thousands of websites at once, for pocket change. A Chinese-speaking hacker used AI agents to break into the websites of over 100 companies, including Deere, Cummins and SharkNinja for about $50 per breach.

“Ondřej Surý will save the internet today.”

Ondřej Surý is a software engineer in Czechia who, as a side project, has spent 20 years packaging PHP fixes into patches website owners can install in minutes instead of weeks.

Researchers found the bugs in August but kept them secret while they built a fix. Days before the announcement, Surý got the call. On release day he published dozens of updates covering PHP versions going back over a decade.

Millions of people like Surý quietly hold the internet together. They’re the reason Y2K was a non-event.

Tech titans, banks and other big companies have legions of these pros, and they are often warned about issues early. The weak spots are mid-sized organizations: supermarkets, hospitals and water plants, big enough to run their own technology but too small for an army of security experts. Their people will be scrambling over the next year.

So what about you and me? The internet is ready with answers.

Advice overload

Matt Shumer’s “The Internet is Under Attack. Here’s How to Protect Yourself and Your Family” includes sensible ideas like two-factor logins, but also says to stay off small websites and unplug smart gadgets. Hardcore preppers are buying portable generators, Starlink Minis and weeks of ready-to-eat meals.

Being prepared is good, but people are busy and endless advice can feel like the dentist who tells you to floss, rinse twice a day, and use a tongue scraper.

I asked ChatGPT what would happen if a hacker broke into my Garmin account. Its answer: “It could see GPS routes and potentially identify your home, regular training locations and when you’re away.”

So a burglar could study my workouts and target my house when I’m out for a run. But a criminal who can hack my Garmin is wasting their talents on my home.

The family password

ChatGPT also told me to stop reusing passwords. Simple enough, but Google Chrome says I’ve logged into 507 different websites over the past decade. A password manager can remember them all, but changing them is a huge chore.

Many families share a password, which is convenient for low-risk sites. If a hacker reviews a book on Goodreads, nerfs my Chess.com rating or exposes my secret lasagna recipe on Allrecipes, the world will keep spinning.

Shared passwords are handy, but when one site gets breached, hackers try that password everywhere else. So assume any password you’ve used more than once is already out there.

That’s fine for Goodreads, but not for the accounts that matter: your primary email, Google, Apple, social media, bank and investment accounts and other things you care about like health records.

For these, use a unique, strong password plus two-factor authentication: a second check, such as a code from an app like Google Authenticator or one texted to your phone.

Also turn on “SIM protection,” which stops hackers from hijacking the phone number your text codes go to. I did this with two clicks on Verizon. AT&T and T-Mobile offer the same thing.

Your identity is already out there

Thanks to data breaches at Equifax and National Public Data, your Social Security number, address, and date of birth are likely circulating via the dark web. Hackers can use these to impersonate you.

Here’s how to protect your identity:

Freeze your credit reports at Experian, TransUnion and Equifax. This blocks anyone from opening a credit card or loan in your name. It’s free, and you can lift the freeze temporarily when needed.

Create an IRS identity protection PIN. This will block someone from filing a tax return in your name.

Be suspicious of phone calls, texts or email about your accounts. If someone asks for personal information, a code or money transfer, hang up and call back using the number on your card or official website. No real company will ask for a code over the phone.

Stay safe out there

These steps cover the biggest risks for most people. Things could get worse, but if hackers start attacking your 401(k) through your wireless printer, it might be time for a portable generator.

There’s an old joke about a pair of hikers who heard a bear growling at them. One stopped and put on his running shoes. His partner said, “You can’t outrun a bear.” He answered, “I don’t need to outrun the bear. I just need to outrun you.”

Hackers go after the softest targets. You don’t need to be perfect, just good enough to get skipped.

---

Thanks for reading! Please consider sharing this edition with friends and family who you want to help stay safe.

Dad Joke: What do you call a bug fix that comes out on Halloween? A pumpkin patch.