A new welcome and website preview video has been added to our Essentials Membership landing page. If you are curious to see what Members have access to...watch and learn: youtu.be/4DN_9dzDkZs

If the Internet breaks this week (or next, or the next) due to AI-powered cyber attacks, it will be because the AI Revolutionaries want to create a "we must do something" scenario which forces a wholesale capture by AI. I wrote about that last week (link below). Regardless, if you use cloud-based services to store files, pictures etc., it is a good practice to regularly download everything to an external hard drive that you keep detached from your computer. Might want to make sure that regular maintenance is done sooner rather than later.

Humans > Machines Human Intelligence > Artificial Intelligence Given cognition > Simulated cognition Having a soul > reading from code Image of God > Image of man Does that mean we humans have the same speed or computational scale? No. But we matter more in every way.

While you are wondering about cybersecurity and what to do to keep yourself safe, secure, and well in this digital age, consider ordering a copy of our book, Practive Security 101 in which we share with you knowledge, strategies, philosophy, and practical steps you can apply in everyday life: amazon.com/dp/B0H4LK1Y93

FAQ Answered: "Exploiting PHP on a website would be game over for the website owner, right?" No. Well, it depends. Take some time to read about the Cyber attack lifecycle, also known as the cyber kill chain. The vulnerability exploitation stage of an attack is just the start. Once exploited, the attacker needs to be able to do something with the asset (server, service, application, account etc.) that they have compromised. The entire attack lifecycle involves: Preparation Staging Weaponization Target discovery Delivery Initial exploit Establishing a foothold Moving laterally / establishing persistence Discovery More lateral movement Final objective And there are sub-stages within that cycle and sometimes the cycle starts over and repeats inside of itself. Many cyber attacks can only get so far before they are blocked or ended for other reasons. With the PHP vulnerability, we're talking about one part of a very long process. It's possible that all of the above can be condensed and automated so that it happens very quickly and only at that initial layer of exploitation. But that is subject to what the adversary is actually able to do on that particular system they have exploited.

FAQ Answered: "Doesn't an attacker with AI have the advantage over defenders?" No. See answer to "should we use AI to defend ourselves." Also, the truth is, defenders always have the advantage. We choose what we deploy and make accessible and on what terms, to what outcomes, on what conditions, and to whom. Cyber attacks can only take advantage of what we expose and only if our exposures create conditions that can be exploitable to any significant gain or harm. Right now, the most sophisticated AI models are simply doing what humans already know how to do (both attack and defense), but they are doing them at a larger scale. That is not an escalation in capability that we cannot overcome, because we already know how to defend against the attacks and combinations of attacks that AI is demonstrating.

FAQ Answered: "If bad guys can use AI to attack us, doesn't that mean we should use AI to defend ourselves?" No. Cybersecurity is won or lost at the strategic level and our existing strategies still work even against the most sophisticated attacks we have seen from AI so far. When most people talk about or promote using AI in cybersecurity, they mean for you to do so for real-time analysis of cyber attacks and to automate actions or countermeasures to reveal and thwart malicious actions as they are happening. That's a tactical approach to solving a strategic problem. People imagine cyber attacks as something like a race between good guys and bad guys. It's not. This is total fantasy and a false narrative often used to sell unnecessary products and services. Some companies promote the idea of "time to detect" or "breakout time," as if the challenge in cybersecurity is analyzing data fast enough to get ahead of an attack as it's happening. That's foolish. Many cyber attacks are automated. By the time you know, it's done. And those are easy to prevent anyway. The difficult ones actually play out over long periods of time - weeks and months - so there is time to spare. LLMs, machine learning, and data analytics platforms do have value in cybersecurity, but they are as sufficient in their mission today as they were 20 years ago. You can use AI operationally - for discovery, code scanning, exposure discovery etc. but we have existing tools and people who can do that already...without the complications, headaches, and unforeseen problems that come with AI.

FAQ Answered: "If AI can hack something, doesn't that mean it is in imminent danger of being hacked by someone else with AI? Aren't these AI companies doing us a favor by getting there first?" No. Cyber attacks are complicated. They don't just happen. They are conducted by people who have motives, capabilities, opportunity, specific targets, and risk/reward calculations. Cyber adversaries (hackers, fraudsters, scammers etc) do not have infinite capabilities or resources or time. And Cyber attacks play out over time and often require numerous attack cycles within what we call a "campaign" in order to achieve the final mission. Just because something is exploitable on the surface (which is what AI is finding), doesn't mean it can be exploited to achieve the final objectives of any adversary who has the intent to carry out an attack against that vulnerable target. And the targets matter. If a cyber adversary who is financially motivated and operates extortion campaigns by stealing and selling credit card numbers comes across a website they can exploit that doesn't collect credit card numbers...then they won't waste their time. So it is with all scenarios. The AI companies are instead creating chaos that need not be but serves their deeper agenda of total transformation of the world.

FAQ Answered: "What is actually happening with all this AI hacking?" Tactically, the AI companies are training their models on how to understand and evaluate software, and they are being trained on known tools, techniques, and procedures for attacking software. Then they are being directed to pursue evaluating and testing popular software and Internet services. From that training they are finding "bugs" in software that if interacted with in a specific way can cause the software to do unexpected things. When bugs that trigger unexpected actions may cause harm or some failure, they are submitted to the cybersecurity industry's vulnerability management services which categorize them and disclose them to the appropriate parties so they can be fixed. Usually software vulnerabilities are disclosed privately so the responsible parties can fix it before it is disclosed publicly. But that depends on the nature of the vulnerability and the fix. Right now, AI models are finding vulnerabilities and developing proof-of-concept exploit methods and the industry is rushing to fix them before they can actually be exploited in the real world. The Internet is not being hacked. The Internet is not breaking. This is self-inflicted hysteria. Strategically, this is the AI companies turning to malicious efforts to try to force their revolution forward. They are attacking the Internet in an attempt to take over software development, IT infrastructure Ops, and cybersecurity by force. In other words, OpenAI and Anthropic have become cyber adversaries using their technology in a form of extortion that forces change to their advantage.

FAQ Answered: "If AI models are finding vulnerabilities that have existed for 10 years, isn't that good? Doesn't that prove the value of using AI for cybersecurity?" Not necessarily, and no. If a vulnerability has persisted that long without us finding it or exploiting it, then it didn't really matter and its discovery is of no value. Also, most of the vulnerabilities being discovered by AI are not exploitable, or if exploited would not result in any material impact.

We are working hard to teach you all you need to know about online threats that affect your heart, mind, body, soul and property. We have an online library of content organized by topic so that you can access to read, listen, or watch based on your schedule and interest. And we have consolidated much of our written content into two books, with more to come. And we are here to be your trusted advisor to help you navigate the churning seas of this digital age and of the AI age to come. Learn more and get started at PractiveSecurity.com

Interesting news on the PHP2Shell front. Multiple organizations from AWS to Cloudflare to private research teams are reporting that attempts to exploit the vulnerability in the wild are not working. Check this out: "“In the 10 hours before it was publicly announced, across the Cloudflare network we saw thousands of attempts to exploit it,” Cloudflare CEO Matthew Prince said early on Thursday. “That jumped to tens of thousands in the 45 minutes post announcement, hundreds of thousands within 2 hours, and millions now.”" securityweek.com/php2shell-e… Another article from The Register quoted security researchers who are testing different techniques for exploitation and none are working yet. This highlights points we made in YouTube videos addressing the Claude Mythos hype from earlier this year. Just because you find a vulnerability and develop a proof-of-concept exploit, does not guarantee any real-world impact. We're still early in this, but OpenAI might have egg on their face, especially after their follow-up hype.

We shared this yesterday for Substack subscribers only, but today we have decided to drop the paywall in the hope that our reflections can help guide the public debate on a very important matter. Now undated and free for all (typos included as proof of life).