FAQ Answered: "Exploiting PHP on a website would be game over for the website owner, right?" No. Well, it depends. Take some time to read about the Cyber attack lifecycle, also known as the cyber kill chain. The vulnerability exploitation stage of an attack is just the start. Once exploited, the attacker needs to be able to do something with the asset (server, service, application, account etc.) that they have compromised. The entire attack lifecycle involves: Preparation Staging Weaponization Target discovery Delivery Initial exploit Establishing a foothold Moving laterally / establishing persistence Discovery More lateral movement Final objective And there are sub-stages within that cycle and sometimes the cycle starts over and repeats inside of itself. Many cyber attacks can only get so far before they are blocked or ended for other reasons. With the PHP vulnerability, we're talking about one part of a very long process. It's possible that all of the above can be condensed and automated so that it happens very quickly and only at that initial layer of exploitation. But that is subject to what the adversary is actually able to do on that particular system they have exploited.

FAQ Answered: "Doesn't an attacker with AI have the advantage over defenders?" No. See answer to "should we use AI to defend ourselves." Also, the truth is, defenders always have the advantage. We choose what we deploy and make accessible and on what terms, to what outcomes, on what conditions, and to whom. Cyber attacks can only take advantage of what we expose and only if our exposures create conditions that can be exploitable to any significant gain or harm. Right now, the most sophisticated AI models are simply doing what humans already know how to do (both attack and defense), but they are doing them at a larger scale. That is not an escalation in capability that we cannot overcome, because we already know how to defend against the attacks and combinations of attacks that AI is demonstrating.

FAQ Answered: "If bad guys can use AI to attack us, doesn't that mean we should use AI to defend ourselves?" No. Cybersecurity is won or lost at the strategic level and our existing strategies still work even against the most sophisticated attacks we have seen from AI so far. When most people talk about or promote using AI in cybersecurity, they mean for you to do so for real-time analysis of cyber attacks and to automate actions or countermeasures to reveal and thwart malicious actions as they are happening. That's a tactical approach to solving a strategic problem. People imagine cyber attacks as something like a race between good guys and bad guys. It's not. This is total fantasy and a false narrative often used to sell unnecessary products and services. Some companies promote the idea of "time to detect" or "breakout time," as if the challenge in cybersecurity is analyzing data fast enough to get ahead of an attack as it's happening. That's foolish. Many cyber attacks are automated. By the time you know, it's done. And those are easy to prevent anyway. The difficult ones actually play out over long periods of time - weeks and months - so there is time to spare. LLMs, machine learning, and data analytics platforms do have value in cybersecurity, but they are as sufficient in their mission today as they were 20 years ago. You can use AI operationally - for discovery, code scanning, exposure discovery etc. but we have existing tools and people who can do that already...without the complications, headaches, and unforeseen problems that come with AI.

FAQ Answered: "If AI can hack something, doesn't that mean it is in imminent danger of being hacked by someone else with AI? Aren't these AI companies doing us a favor by getting there first?" No. Cyber attacks are complicated. They don't just happen. They are conducted by people who have motives, capabilities, opportunity, specific targets, and risk/reward calculations. Cyber adversaries (hackers, fraudsters, scammers etc) do not have infinite capabilities or resources or time. And Cyber attacks play out over time and often require numerous attack cycles within what we call a "campaign" in order to achieve the final mission. Just because something is exploitable on the surface (which is what AI is finding), doesn't mean it can be exploited to achieve the final objectives of any adversary who has the intent to carry out an attack against that vulnerable target. And the targets matter. If a cyber adversary who is financially motivated and operates extortion campaigns by stealing and selling credit card numbers comes across a website they can exploit that doesn't collect credit card numbers...then they won't waste their time. So it is with all scenarios. The AI companies are instead creating chaos that need not be but serves their deeper agenda of total transformation of the world.

FAQ Answered: "What is actually happening with all this AI hacking?" Tactically, the AI companies are training their models on how to understand and evaluate software, and they are being trained on known tools, techniques, and procedures for attacking software. Then they are being directed to pursue evaluating and testing popular software and Internet services. From that training they are finding "bugs" in software that if interacted with in a specific way can cause the software to do unexpected things. When bugs that trigger unexpected actions may cause harm or some failure, they are submitted to the cybersecurity industry's vulnerability management services which categorize them and disclose them to the appropriate parties so they can be fixed. Usually software vulnerabilities are disclosed privately so the responsible parties can fix it before it is disclosed publicly. But that depends on the nature of the vulnerability and the fix. Right now, AI models are finding vulnerabilities and developing proof-of-concept exploit methods and the industry is rushing to fix them before they can actually be exploited in the real world. The Internet is not being hacked. The Internet is not breaking. This is self-inflicted hysteria. Strategically, this is the AI companies turning to malicious efforts to try to force their revolution forward. They are attacking the Internet in an attempt to take over software development, IT infrastructure Ops, and cybersecurity by force. In other words, OpenAI and Anthropic have become cyber adversaries using their technology in a form of extortion that forces change to their advantage.

FAQ Answered: "If AI models are finding vulnerabilities that have existed for 10 years, isn't that good? Doesn't that prove the value of using AI for cybersecurity?" Not necessarily, and no. If a vulnerability has persisted that long without us finding it or exploiting it, then it didn't really matter and its discovery is of no value. Also, most of the vulnerabilities being discovered by AI are not exploitable, or if exploited would not result in any material impact.

There are some common questions that are forming around the advisories we have been issuing and also posting at @MattInformed . Here's some quick answers: Q: Why are we not recommending the Brave browser? A: We have no opinion about Brave one way or another. We will assess it soon and provide feedback to our customers in an upcoming tool review. Q: Why are we not recommending the Chrome browser? A: Because we regard Google as a predatory company that undermines personal security and privacy for their profit. They may be fast to fix security updates, but they also work aggressively to exploit you as a person. We consider Chrome as spyware and a tool for influence operations. Q: Why do we recommend Safari since Apple tends to be slow to release updates? A: Because Apple as a company has a long-standing culture of proactive security, high quality control for updates, and an inherent respect for privacy. This does make them slower to update, but you are better protected in the long-term. Q: Why are we recommending against iOS 27? A: See our Substack for our recent article on this. TLDR: Siri AI embedded into the foundation of the OS is a no-go for us. Q: Why do we recommend against Passkey? A: Because the assumed security in Passkey architecture is that whomever has your device and can unlock it is you, and an unlocked phone grants applications access to passkeys needed to unlock online accounts. That defeats the purpose of MFA. It's actually pretty terrible. It'c convenience over security. Q: What credentials do you have to make these claims and recommendations? A: See practivesecurity.com/about

Why is a root certificate compromise such a big deal? Well, certificate authorities are responsible for helping website and web service providers prove their identity and authenticity to their customers and client software. They are also used in the data encryption process. This is part of a system of distributed trust that the Internet depends on. Think of it this way: if you are in a room of 1000 people and you want to find everyone named Matt, you might call out "hey, who here is named Matt?" You might see 10-15 people raise their hand making the claim that they are so named. Some might be, some might not be. How do you know who is being authentic and who might be deceiving you? How do you know who you can trust? You need some external authority that can validate the identity of those who are claiming it as their own. In the real world we often used government IDs that are issued and signed by authorities. On the Internet, we use root certificate authorities (RCAs) to be that external identity authority that websites can use to in order to prove they are part of a service architecture they claim to be. To prove their identity, a website operator submits a signed copy of a digital certificate to the root CA (RCA), and the root CA adds their own signature, making the identity certificate valid and anyone who possesses it the rightful bearer of that identity. For example, if you try to connect to Amazon with your browser, your computer will call out to the Internet asking where the nearest Amazon server is. Many websites can answer by that name or you can be directed to a specific one through malware or hacking. Certificates signed as valid by RCAs are used by the answering websites so that the real Amazon servers can be distinguished from the fake ones. Any server that claims to be Amazon but doesn't present a signed certificate from an RCA, can't be trusted as authentic. But if an attacker gains a root certificate that is used to sign the certificates of websites and web services, then they can create forged certificates and make the claim that they share the identity of the legitimate servers and websites they are spoofing or claiming to be. They can create forged Internet IDs. Your browser and your web application won't know they are being lied to. Thinking of that room full of Matts, let's say you ask all who raised their hand to show their driver's license to prove their identity. You trust that the DMV has validated each Matt's identity when they issued them their ID card. But what if one of the alleged Matts had access to the DMV machines that print drivers licenses and could create one without the normal verification process? You would have no way of knowing that they are lying about their identity, because they presented valid credentials. They might be Jim but have a valid ID that says they are Matt. That's what's going on with the root certificate authority issue. That's why it's potentially really bad. However, last I looked, the stolen certificates had been invalidated and should not be usable...but that invalidation process can take time and might have some gaps.

Our initial advisory is now available for the PHP issue. This is an early warning advisory with more to come later today. practivesecurity.substack.co…

Parents, AI adoption among minors is very high at well over 60% as of 2025 data and at least 30% of teens reported finding AI companions to be more personally fulfilling than their real world friends. And right now there is a national effort among Conservatives in our legislative bodies (state and federal) to prevent your kids from accessing AI. Meanwhile, our First Lady and President are setting up national programs that encourage our children to use AI everyday and to become "AI native" in their posture toward the future. Are you preparing your kids to regard this technology in the proper and healthy way? Are you aware of the dangers and the benefits? Do you need help? We have loads of articles, podcasts, and several presentations geared to help you. If you'd like an overview in seminar / video format, we have one available through our website called the AI Workshop for Parents. If you'd like to browse our content theme by theme, check out the AI page available for our Essentials Members. In our AI Workshop we provide you an overview of the AI technology and its origins so you first understand what it is (and what it isn't). Then I walk you through the nature of the revolution, the primary methods of use in everyday life, before we dive into analyzing the deeper aspects of this transformational moment in history, wrapping up with practical recommendations for what you can do in your life and with your family. Learn more at practivesecurity.com/essenti… Sign up today at practivesecurity.com/signup

Content highlight on AI: if you are looking for an exploration into the simple truths of what AI is and how we should approach it, we have you covered. Get started with these articles, which attempt to cut to the chase in a very practical sense. They are a blend of thinking through the deeper issues while guiding us to some practical application in the real world as we encounter AI and are considering if, how, and when to use it, while safeguarding ourselves from the potential harms use can bring: AI Essentials Rules for the Proper Use of AI AI is Never Just a Tool An Ethical Framework for AI You will find these on our Artificial Intelligence page of our website, accessible only to our Essentials Members.

Fresh FAQ on the top of the stack (no paywall): Who Is Practive Security, and Why? practivesecurity.substack.co…

Several of our articles available for Essentials Members at PractiveSecurity.com have been updated and reposted today. Members can easily see the updated versions based on the tag at the top of each one that lists the recent revision date. One of those is one of our favorites: Essential Online Safety for Kids. What does Dr. Iain McGilchrist have to do with cybersecurity? Read (or listen) to find out.

Another of our favorites that has been edited (and improved) is "Guarding Our Attention." It is available on Substack and our Personal Security page at PractiveSecurity.com As we review the topics of digital health and online security, we draw from Biblical wisdom as well as that from Jonathan Pageau, Iain McGilchrist, C.S. Lewis, and Josh Herring. We hope this helps: practivesecurity.substack.co…

The mission of Practive Security is simple: bring our decades of experience in cybersecurity to everyone who can benefit from our knowledge, lessons learned, and wisdom gained. We aim to help you understand the threats that exist and how to defend against them so that your heart, mind, body, soul, and property is protected from those who mean you harm. That includes protection from those who view us simply as a means for enrichment. We are setting the table with what believe is a feast that is good to partake in. We believe you will be strengthened through the knowledge we offer. At least that is our sincere hope: to serve you well so that you are equipped to thrive in this digital age. Many people have told us, "if someone had warned me before, then I could have prevented this." We hope to fill that gap. If you would like to partake, sign up at PractiveSecurity.com. We have two main focus areas. Our Essentials Membership is for everyone. Our Business Essentials / Pro Membership is for professional contexts, but anyone from the self-employed, to small businesses, organizations, and enterprises. The threats are real. You can defend against them. We are here to help you in that endeavor. Because you matter.

Parents, the AI revolution is rapidly growing and our children are being encouraged to participate - even transform their future for what is being called the post-AI world. What does that mean? What are the dangers? How do we prepare them? We have you covered. We offer a dedicated seminar (pre-recorded) that introduces parents to the AI Revolution along with our analysis of this time and what we should do about it. We also have a dedicated article written to parents who are wondering, "how do I prepare my kids for the AI world." And of course we have our full-length book, Countering the AI Revolution, which is packed full of detailed analysis, technical explanations, personal experiences, philosophical considerations, and theological implications. We're here to help. Links below:

Our smartphones and laptops connect us to the Internet while our email, web browser, and dedicated-apps provide a direct conduit between the digital world and our minds: they are the conduit into our souls AND they bridge to our physical assets. Learn more about what to protect and how via our book, Practive Security 101, or sign-up for our Essentials Membership on our website. Links below.