The Hero Who Protected the Internet

If you’re reading this, the internet is still online. Yet we shouldn’t assume this calm will persist after this week’s global cybersecurity upheaval.

“Think about it this way: millions of structures share the same broken lock, and now everyone knows how to pick it,” Matt Shumer wrote in a lengthy post on X about the situation. “The lock manufacturer has issued a fix, but every building owner must install it themselves, and many haven’t done so yet.”

That wide-reaching vulnerability was uncovered with assistance from AI, but the expanding power of AI-powered hackers means vulnerabilities can be exploited much more quickly as well.

This is the reality we inhabit today. In August, more than a hundred tech firms signed a letter warning about precisely this risk. On Thursday, one of Anthropic’s chief information security officers warned that cybersecurity threats “will get significantly worse before they get any better.” Major banks rushed to shore up defenses after reports of autonomous agents operating inside accounts (though many may have been authorized by the account holders).

This most likely won’t be the last incident of its kind. Cybersecurity outfit CrowdStrike noted that August brought twice as many “agentic intrusions”—hacks executed by an autonomous or semi-autonomous AI—as July did, with September doubling that figure again.

Indeed, this is unnerving, to be sure. As is often the case, however, prevention beats panic.

Shumer’s note includes several practical steps for stronger online security—put particular emphasis on safeguarding your email accounts since they act as the gateway to much of what we do online. Here is a 15-step plan to stay safer in the AI era. (And if you’re genuinely anxious about everything collapsing, Reason has you covered there as well.) If updates are available for your devices and browsers, install them. And for the love of all things digital, avoid clicking on unfamiliar links from dubious emails!

The man who (maybe) saved the internet? There’s an old XKCD webcomic—and yes, I’m revealing my age by acknowledging it—that seems to capture this week’s events with surprising accuracy. Here it is:

And here’s the wild part: this is largely accurate—except the lone outlier lives in Czechia rather than Nebraska. His name is Ondřej Surý, and Charlie Warzel of The Atlantic tracked him down:

Surý, who resides in the Czech Republic, does not work for the PHP Foundation. Yet alongside his day job as director of domain-name-system engineering at the nonprofit Internet Systems Consortium, he volunteers to maintain and automate patches for the programming language. His efforts, together with a small group of others, have enabled countless websites and organizations to patch these vulnerabilities swiftly. In the last 48 hours, he’s arguably become the internet’s unsung hero—while his compensation comes only from modest donations. “Ondřej will save the internet today,” a user on the PHP Subreddit wrote.

In the ongoing battle between AI attackers and AI defenders, humans remain the true heroes—at least for now.

Art of the steal. Yesterday, in this space, I noted voters’ growing frustration with what looks like a never-ending flow of corruption within the Trump administration. But in just a day, another scandal surfaces—thanks to a Vanity Fair piece about President Donald Trump’s son-in-law, Jared Kushner.

The article is an excerpt from an upcoming book. It alleges that Dutch investigators accessed Kushner’s phone with help from Russian hackers. The data from the phone and other sources allegedly show Kushner receiving funds from the governments of Saudi Arabia and the United Arab Emirates to “press their agenda with Trump.” Kushner calls the article’s assertions “outrageous and categorically false.”

But there’s more on the corruption front. The Justice Department is reportedly examining whether Trump ally Corey Lewandowski profited from his role as a top adviser at the Department of Homeland Security (DHS). The Washington Post notes the probe stems from a referral by the DHS inspector general and centers on “contracting fraud.”

Lewandowski has denied the allegations. He no longer serves at the department, having been dismissed earlier this year amid a controversy involving then–DHS Secretary Kristi Noem, who also lost her job.

Scenes from Virginia: Federal prosecutors charged state Sen. L. Louise Lucas (D–Portsmouth), among Virginia’s most influential Democrats, with racketeering and money laundering tied to illegal marijuana sales. (If you’re wondering, recreational marijuana has been legal in Virginia since 2021, yet commercial sales remain restricted. It’s a little strange that using a substance is permitted while selling it is not.)

Lucas backed the failed Virginia redistricting push and has been a vocal Trump critic. She intends to contest the charges. Virginia Governor Abigail Spanberger, also a Democrat, commented that the indictment timing—just days before elections—”further erodes the trust the American people deserve to have in the Department of Justice.”

QUICK HITS

• “The last memory José García-Sorto has after a chest wound is being dragged from his car, pressed to the asphalt, and handcuffed, with his blood pooling around him on a Phoenix highway. He feared for what would happen to his two young children if he died.” The New York Times offers a harrowing account of a Honduran immigrant shot by immigration officials last year. He’s never faced charges related to the incident, suggesting authorities found no evidence that he endangered anyone.
• Phil Magness and David Hebert debunk the idea that tariffs can foster “infant industries” to compete globally.
• The Cato Institute released its annual “Freedom in the 50 States” ranking. Arizona tops the list. Curious how your state fared?
• Alchemy on the horizon? A California firm claims to have turned mercury into gold.
• The World Series begins tonight, and it promises to be exciting. Despite lower payrolls, the Rays and Brewers emerged as top teams in their leagues this year—teams rich in depth and personalities worth rooting for. The Brewers’ Jacob Misiorowski is a huge Pokémon enthusiast; the Rays’ Yandy Díaz escaped Cuba after imprisonment there. This is also the first World Series since 1980 to pair two franchises that have never before won it all.