This is going to be the most important letter I publish this year.

Don’t skip it.

Because inside I’m going to show you what’s happening to the internet right now. Who’s breaking in. Why a break-in now costs pennies on the dollar. 

Then I’ll show you FOUR things you can do about it before dinner. Will they be fun? No. Flossing isn’t fun either. But nobody ever regrets flossing.

“Shut it All Down!”

On Wednesday, the Dutch government’s cybersecurity agency unplugged its own website.

Then the national login system people use for taxes and benefits went dark. Then Parliament. The Port of Rotterdam. Hospitals.

Germany followed. France. Finland. Belgium. The Czech Republic.

All falling like dominoes. Boom. Boom. Boom.

In Washington, the NSA told organizations to do the same if they couldn’t fix the problem fast. In Tokyo, the prime minister went on X: “We have an urgent request for everyone to take action tonight.” Tens of millions saw it.

What problem?

Two flaws in software you’ve probably never heard of. It’s called PHP. It runs about 70% of the world’s websites. Including, most likely, some you visited today.

The flaws have a nickname: PHP2Shell. In plain English, a stranger could walk into the computer behind a website and take control. No password needed.

The fix was due Thursday. Then details leaked. One research firm accidentally posted a video showing how the break-in works. The fix went out a day early.

Then the race began.

The Doorknob Test 

Cloudflare guards millions of websites. It counted thousands of break-in attempts in the ten hours before the announcement. Tens of thousands in the 45 minutes after. Millions by the next morning.

Amazon says someone was already trying the break-in on October 17. Four days before the public knew.

That’s why governments unplugged.

Here’s what worries me. 

About 2.6 million of these website computers are reachable online. More than a million run versions so old PHP no longer sends them fixes. And changing the lock does nothing about a burglar already inside.

Some people are already calling this month Black October. Here’s what else happened this week:

• Stop & Shop, Food Lion and Hannaford, three big grocery chains, had their websites and apps knocked offline for days. The stores stayed open. Online orders didn’t.
  
  
• State Bank of India, the country’s biggest bank, confirmed 3,897 customers’ personal details turned up for sale online.
  
  
• A crime group used AI assistants working as a team to target more than 400 banks and payment companies in Latin America.

None of these are connected to each other. That’s what’s scary.

AI helped researchers find PHP2Shell. AI also helped criminals hunt those banks. Same technology. Both sides.

One hacker typed an instruction under 100 characters long and let AI do the rest. The AI broke into more than 100 companies, including John Deere. Cost per break-in: about $50.

America’s biggest banks aren’t waiting. JPMorgan, Schwab, Citi and Bank of America now block outside AI programs from logging into customer accounts.

Flaws that used to take months to turn into weapons now take hours.

So here’s what you need to do. 

1. ASSUME SOMEONE HAS YOUR INFO. Change your important passwords. Freeze your credit at all three bureaus: Equifax, Experian and TransUnion. It’s free and takes ten minutes. If anyone asks for any account code just sent to your phone, it’s a scam. If someone calls you from Google, your bank, Robinhood, or Coinbase? IT’S A SCAM. Every time.Also, don’t panic. Panic is what scammers count on and it’s the one thing that makes you vulnerable.

2.GET AND USE PASSKEYS, PREFERABLY HARDWARE KEYS. First thing, open your phone company’s app and look for a setting called SIM Protection, Number Lock or Account Lock. Turn it on. Those six-digit codes your bank texts you? A criminal (or even an AI) can trick your phone company into moving your number to his phone. It’s called a SIM swap. Then your codes go to him. Turning on SIM locks will offer a layer of protection.

Second thing: a hardware key, like a YubiKey. This is a small key that plugs into your computer or phone. No physical key, no login. Unlike a password, a hacker in another country can’t steal it. Attackers would have to take it from you physically. And even then, they would still need your password or PIN. Password managers, Google, Apple, Microsoft and the big crypto exchanges allow you to use them. Buy at least two and keep one hidden as a backup. Always buy direct from the manufacturer.

But these keys take a few days to arrive. In the meantime, wherever a site offers a “passkey” or an authenticator app, turn it on. 

The ranking:

1. Hardware keys and passkeys: strongest.
2. Authenticator apps: good.
3. Text-message codes: weak.

3. UPDATE EVERYTHING. Your phone. Your computer. Your web browser. Your home Wi-Fi router. When the Settings menu says an update is ready, install it. That’s you changing your own locks. If you bought your router and it’s old, flip it over and find the model number on the sticker. Search that number with the words “end of life.” If the maker says it no longer supports that model, replace it. If your internet company gave you the router, call them. They can tell you if it’s current. It sucks. But do it. One warning: never install an “update” from a pop-up on a website or a link in a text or email. That’s a classic scam.

4. SHUT THE SIDE DOORS. Every account, app and gadget is another way in. Delete apps you don’t use. Unplug smart gadgets you don’t need. If you have an Alexa, go to settings and turn off voice purchasing. (Also, press mute when you want the microphone off.) Use a different password for every account; have your passkey-protected password manager remember them. Never give your bank login to an app or AI agent. And for the next few weeks, don’t type a password or card number into a website you don’t know. 

BONUS: IF YOU OWN CRYPTO. The biggest blockchains, Bitcoin and Ethereum, were designed on the assumption that everyone’s a thief. Their ledgers live on thousands of computers at once, so there’s no single one to break into. They’ve stood open to every hacker on Earth for years. 

BUT… the weak spots are everything built around them: exchanges, apps, websites. And if someone steals your coins, there’s no bank to call. Choose wisely how you hold your keys—or who holds them. If you hold crypto in a wallet, be careful clicking “connect wallet” on ANY website this month. A hijacked website can swap in a fake button that drains your wallet.

Somewhere right now, a computer that runs your bank, your doctor or your kid’s school is waiting on a fix.

You can’t fix that one. You can fix your own.