You may not have heard much about it. Students in my cybersecurity class did. I scrapped the plan for our next lecture to cover it.
The main cause was PHP2Shell, a pair of vulnerabilities, or security flaws, in PHP, the programming language behind about 70% of the websites whose language is known. The vulnerabilities, which let an attacker take over a web server, had lurked in the language since at least 2012 until a researcher working with an OpenAI model found them. PHP’s maintainers released a patch on Oct. 21, but attacks were already under way. And a patch protects only the servers on which it is installed.
AI can now derive from a patch what vulnerability it fixes and how to exploit it, work that once required intelligence services or elite hacking groups. Defenders have not kept up. Qualys counted 167 million PHP installations on its customers’ systems. Twelve hours after disclosure, about one in a thousand had been updated.
The gap can last weeks. On Oct. 27, Anthropic said its Claude model had written an exploit that seizes control of some Linux servers through a vulnerability in how they handle network connections. Linux’s developers fixed it on Oct. 5. As of Nov. 2, Ubuntu, one of the most widely used versions of Linux for servers, still had not shipped the fix.
Unpatched vulnerabilities are where many damaging attacks begin. In March 2017, the Apache Software Foundation patched a vulnerability in Struts, software that companies use to build websites. Two months later, attackers used it to break into Equifax, which had not installed the patch, and went on to steal personal data on 147 million Americans.
Using Media Cloud, an open archive of online news, I measured how much national outlets covered 25 major cyber events, and the Struts patch, in the eight days after each became public. Not one national outlet I tracked published a story about the patch. The Equifax breach drew a median of 16 of every 1,000 stories each outlet published.
If it bleeds, it leads. Covering the breach but not the patch is like reporting a hurricane’s destruction but never its forecast.
Last month was no different. Media Cloud’s October index of The New York Times, The Washington Post and The Wall Street Journal is incomplete. But in the eight days after PHP2Shell became public on Oct. 20, CNN, Fox News, NPR and USA Today published 5,610 stories, and only nine mentioned it or the week’s other major vulnerabilities. Two put them in a headline.
Courtesy of Bryan C. Ward
Not every vulnerability deserves a headline. A record 5,461 were published in the week of Oct. 12 alone, more than 15 times the weekly average in 2020. Most matter only to specialists. But some could affect nearly everyone. The Storm Center flagged 10 such events from 2010 through 2021. For six of them, the median national outlet ran no story.
Courtesy of Bryan C. Ward
Increasingly powerful AI systems are driving this surge. In the long run, finding and fixing vulnerabilities will make us safer. In the short run, the surge hands attackers a flood of unpatched targets.
The public needs the equivalent of a hurricane watch. The National Weather Service issues watches and warnings in plain language, and newsrooms carry them. CISA, the federal Cybersecurity and Infrastructure Security Agency, should do the same: a public watch when a critical vulnerability turns up in widely used software, and a warning when attacks begin. Newsrooms already cover car and food recalls. They should cover these warnings, too.
The Congress that takes office in January will decide whether and how to pace the AI frontier, how much to spend on the agencies that warn us and who pays when a company’s unpatched server exposes its customers.
Even AI companies are sounding the alarm. Jason Clinton, Anthropic’s deputy chief information security officer, wrote last month that things “are going to get a lot worse before they get better,” and urged security leaders to “go to your boards and ask for help right now.”
AI is reshaping the threat by the week, but deciding how to respond still falls to human intelligence: to lawmakers, to corporate boards and to the public they answer to. None of them can weigh risks they have not heard about.
Equifax had two months to install its patch. PHP2Shell’s targets were under attack before theirs existed. We don’t wait for the storm surge to tell people a hurricane is coming. We shouldn’t wait for the breach to tell the public, either.
The opinions expressed in Fortune.com commentary pieces are solely the views of their authors and do not necessarily reflect the opinions and beliefs of Fortune.