1. Paul Kedrosky:
Increasingly capable AI systems are making it possible to discover and exploit software vulnerabilities at speeds and scales that were previously unimaginable. The world’s enormous installed base of software, much of it old, poorly maintained, and deeply interconnected, is a soft target. We are entering what some call The Hackening, a period of radical technological instability where systemic frailties are everywhere.
You can see it everywhere. For example, the Port of Los Angeles recently reported more cyberattacks per month than it saw in entire years before 2020.
This might be less worrisome if the number of reported software vulnerabilities was not exploding. But it is. After years of steady increases, disclosures of common vulnerabilities (CVEs) accelerated sharply in 2026, with monthly reports now running at several times their 2025 levels. (Sources: paulkedrosky.com, thezvi.substack.com)
(Source: paulkedrosky.com)
2. Kedrosky again:
The global economy runs on interconnected software systems whose security depends on finding and fixing vulnerabilities before they can be exploited. AI is making it vastly cheaper, faster, and easier to search those systems for weaknesses, including in code that has been running for decades.
The result is an increasingly expensive, automated arms race in cybersecurity, with huge advantages for attackers and serious consequences for businesses, infrastructure, and governments. The economic costs of “the Hackening” will likely be enormous. (Source: paulkedrosky.com)
3. The discovery of two serious flaws in PHP this week set off a global scramble to keep websites safe from hackers, showing just how critical the three-decade-old open-source programming language is to the internet. Yet the nonprofit foundation that supports PHP, which may underpin up to 70% of sites globally, operates on a shoestring budget. “We have one full-time staff member (that's me) and 14 mostly part-time contractors,” Executive Director Elizabeth Barron of the PHP Foundation said via email in an interview on Friday. Board members are unpaid volunteers, and funding comes from donations and grants. (Source: reuters.com)
