Cyber threat level raised for first time since 2021, yet coverage lagged, analysis finds

Ward, whose students in his cybersecurity class had heard about the alert, reports that Finland took government websites offline and the Dutch parliament's site went dark, and that the US National Security Agency and Britain's National Cyber Security Centre urged organizations to take offline any system they could not fix at once.

The centre had raised its level only 10 times since 2010, by its own records. The main cause, Ward says, was PHP2Shell, a pair of vulnerabilities in PHP, the language behind about 70 percent of websites whose language is known. The flaws, which let an attacker take over a web server, had lurked in the language since at least 2012 until a researcher working with an OpenAI model found them. PHP's maintainers released a patch on Oct. 21, but attacks were already under way, and a patch protects only the servers on which it is installed.

Ward argues AI has changed the stakes: systems can now derive from a patch what vulnerability it fixes and how to exploit it, work that once required intelligence services or elite hacking groups. He cites security firm Qualys counting 167 million PHP installations on its customers' systems, with about one in a thousand updated 12 hours after disclosure. He also notes that on Oct. 27 Anthropic said its Claude model had written an exploit that seizes control of some Linux servers through a vulnerability in how they handle network connections; Linux's developers fixed it on Oct. 5, but as of Nov. 2 Ubuntu, one of the most widely used versions of Linux for servers, still had not shipped the fix.

Using Media Cloud, an open archive of online news, Ward measured coverage of 25 major cyber events in the eight days after each became public. In the eight days after PHP2Shell became public on Oct. 20, CNN, Fox News, NPR and USA Today published 5,610 stories, and only nine mentioned it or the week's other major vulnerabilities; two put them in a headline. A record 5,461 vulnerabilities were published in the week of Oct. 12 alone, more than 15 times the weekly average in 2020, and of the 10 events the Storm Center flagged from 2010 through 2021, the median national outlet ran no story on six.

Ward cites the 2017 Equifax breach as the pattern: the Apache Software Foundation patched a vulnerability in Struts in March 2017, and two months later attackers used it to break into Equifax, which had not installed the patch, stealing personal data on 147 million Americans. Not one national outlet he tracked published a story about the patch, he says.

He argues CISA, the federal Cybersecurity and Infrastructure Security Agency, should issue a public watch when a critical vulnerability turns up in widely used software and a warning when attacks begin, and that newsrooms should cover these warnings as they cover car and food recalls. The Congress that takes office in January will decide whether and how to pace the AI frontier, how much to spend on the agencies that warn the public, and who pays when a company's unpatched server exposes its customers, he writes.

Even AI companies are sounding the alarm, Ward says. Jason Clinton, Anthropic's deputy chief information security officer, wrote last month that things "are going to get a lot worse before they get better" and urged security leaders to "go to your boards and ask for help right now."