Welcome to the Valley of Pain

This week may go down as one of the worst weeks ever for internet security. Major weaknesses were found in software used by millions of websites, hospitals, and companies around the world. Some of those companies had to shut down their online services just to stay safe. Experts say this is only the beginning of a long and dangerous period for the internet.

One of the biggest problems involved PHP, a coding language used by about 70 percent of all websites. Hackers tried to exploit its weaknesses millions of times in just a few days. Governments, hospitals, and businesses took their websites offline to protect themselves while fixes were being worked on.

But PHP was not the only problem. Security flaws were also found in software used by big companies like Netflix, PayPal, and Walmart. A medical testing company called Quest Diagnostics — which runs lab tests for one in three American adults every year — also said hackers had broken into its systems. Cybersecurity expert Sam Rubin said it had been 'quite a busy week,' and he had not even heard about all the attacks yet.

Security experts are calling this period 'Black October.' But the scariest part is that by next year, weeks like this might feel completely normal. Matthew Prince, the CEO of an internet security company called Cloudflare, said this story feels new right now, but in a few months it will feel like something that happens every week. He even knows about more security flaws that have not been announced yet.

Why is this happening now? For decades, a lot of software was written quickly and without careful checks for security problems. For a long time, that was not a big deal because there were very few skilled hackers. But people have gotten used to typing their credit card numbers and addresses into websites without thinking — even though the internet was always a risky place.

The biggest change is artificial intelligence, or AI. AI tools can now act like a huge, cheap army of hackers that never gets tired. In just the past few months, free AI programs have gotten very good at finding weaknesses in software and launching attacks automatically. Rubin said the internet is entering a 'valley of pain,' and another expert said, 'I think it's going to get a lot worse, actually.'

One example of how serious this is: a company called CrowdStrike linked a wave of cyberattacks on South Korean banks to a single 26-year-old in China. After he stole the data, he did not even know what to do with it — so he asked an AI chatbot how to sell it. Meyers said the attacker 'didn't know what he was doing.' CrowdStrike is now finding a new AI-powered hacking operation every two hours.

Fixing all of this will take a huge effort from many different groups working together. Security companies have been quietly setting up temporary shields while permanent fixes are made. But not every website uses these protections, and many companies are slow to update their software. Some experts believe AI will eventually help find and fix most security problems, but getting there could take a very long time.

In the meantime, experts say everyone should be more careful online. You should delete browser extensions you do not use, avoid reusing passwords on different websites, and think carefully about which companies you trust. Even a small hobby website — like one for trading Pokémon cards or tracking bird sightings — could be hacked and used to steal your password or credit card number. Experts also say it is safer to use big services like Gmail and Dropbox, because large companies have more resources to fight off attacks.

The road ahead is uncertain, but there are two possible futures. If experts can find and fix all the major security flaws, the internet could become a safer and more open place for everyone. But another possible future is one where only websites run by big tech companies are considered safe to use. Either way, the internet is changing fast — and for now, everyone needs to be more careful than ever.