Did someone forward this to you? Get it free every Friday →
⚠ THE PANIC METER · THIS WEEK
7/10 · Lock the doors. The robots are trying handles.
AI agents breaking into company websites on their own, for pocket change, is new. So is a patching scramble across much of the web, and together they move the needle up a point. Readers voted Head for the bunker last week, and they had a point. But the defenses are the same boring ones, and they still work. Up from 6.
Issue 3 · Week of October 26, 2026 · This week's lead
One hacker sent AI agents after 1,200 websites. Here's your 30-minute lockdown.
Hello from the bunker.
The robots have learned to pick locks, cheaply and in bulk. Reuters reported that one hacker set a pack of AI agents loose on more than 1,200 websites and got into over 100 of them, at roughly $50 a break-in.
Then, two days later, it turned out PHP, the software behind roughly 7 in 10 websites, had two serious holes, found with help from AI. Some government sites went dark while they patched, and on Monday the US government's cyber agency said attackers are now using them. Australia's cyber agency, meanwhile, says AI has become the defining force in online threats over the past year. The good news: the robots mostly try the doors that are already open.
So this is a security issue, with one job per level. This weekend: lock down your own accounts in half an hour, freeze the family's credit for free, put a spending cap on any work account that can spend, send your web person five questions, and switch on the free scam guard already sitting in your browser.
This Week's Five
The most useful things to try this weekend.
01 · Lock down your email first. Then everything
Stay Safe · 15-minute job. One hacker's AI agents tried more than 1,200 websites and got into over 100, at about $50 a break-in, Reuters reported. Cheap attacks try everyone, and they mostly walk through open doors: reused passwords, no two-step login, old software. Start with your email, because every password reset goes there.
02 · Freeze your credit. Everyone's
Home & Family · 15-minute job. Assume some of your details are already loose. A credit freeze is free at Equifax, Experian and TransUnion, doesn't touch your credit score, and stops crooks opening new credit in your name. Parents can freeze their kids' credit too.
03 · Put a spending cap on every account that spends
Your Career · 15-minute job. Attackers stole stored AI account keys from about 1.4% of OpenCode's console users and ran up charges, mostly hundreds of dollars, some over $1,000. Any work account that can spend money needs a limit and an alert.
04 · Ask your web person these five questions
Your Business · Get help. The AI agents went after websites, mostly online shops, and serious flaws turned up in PHP, the software behind a big share of small-business sites. Fixes are out, and attackers are now using the holes. Five questions to make sure yours has them.
05 · Switch on Chrome's free scam guard
Stay Safe · Try it now. Chrome's Enhanced protection setting now uses Google's Gemini AI to flag fake virus and fake update pages, and warns before you paste a "ClickFix" command. The rule that goes with it: no real website ever asks you to paste a command.
THIS WEEK'S WORRY
Did the internet nearly break last week? And what comes next?
Not quite, but it was a real scramble. On October 21, PHP, the software that runs roughly 7 in 10 websites, released fixes for two serious flaws that can let an attacker take over a server running an old version. AI tools helped the security firm Wiz and an OpenAI-led effort find them first. The FBI told site operators who couldn't update right away to take their sites offline, and some government sites in the UK, Finland and Japan briefly went dark while they patched. Japan's government said it had no reports of damage.
That's where the "70% of websites" headlines came from: it's the share of sites that use PHP, not the number that were at risk or hacked. The risk is real for sites that haven't updated, though. On October 26, the US cyber agency CISA said the flaws are now being exploited in attacks and gave federal agencies until October 29 to fix them. No victims have been named. The scanning firm Censys still counted more than 32 million PHP services on an affected version.
What comes next is more of the same, faster. AI is now digging up old holes in everyday software, which is good news when the fix ships first and bad news for anyone who doesn't install it. One security expert told the AP this is "just the very early tremors." Another said we shouldn't treat it as a scenario where we're all doomed. We agree with both.
What to actually do: you can't patch the internet, but you can patch your corner of it. Turn on automatic updates on your phone, computer and Wi-Fi router, and restart when they ask. If you have a business website, ask whoever runs it one question this week: "Are we on the October 21 PHP fix?" Then keep the boring habits in this issue: unique passwords, two-step login, a credit freeze. They work whichever hole is in the news.
Dispatches from the Slopocalypse
Slop Watch: the Heroic Animal Rescue
A man finds a polar bear cub that can't walk, nurses it for a year and releases it into the wild. An officer helps a mother bear free her cub from a highway barrier. Both clips spread on social media in the past few weeks. Both were made by AI. Fact-checkers at Lead Stories traced the polar bear video to an Instagram account whose bio says it makes AI-generated videos, and the original post carried an AI label. Detection tools found an AI watermark in parts of it. The bear-cub clip scored high on an AI detector and carried a hidden watermark from an AI video tool. Feel-good animal videos are cheap to make and easy to share, which is exactly why they're everywhere.
Find the original post. Check the account's bio and other videos: a whole feed of miracle rescues is a clue.
Look for an AI label. Instagram shows creator-added ones under "About this reel."
Too cinematic? Real rescues are shaky, badly framed and rarely have perfect lighting.
No news report, no named rescuer, no place? Treat it as a story, not news.
AI detectors are one clue, not a verdict.
Prompt of the week: the security checkup coach
Copy this into ChatGPT, Claude or Gemini. List your accounts and devices, never your passwords.
I want to do a 30-minute security checkup on my own accounts and devices. Act as a patient coach. Here is a list of my accounts and devices, without any passwords: [list, e.g. Gmail, bank, credit card, Amazon, iPhone, Windows laptop, home Wi-Fi router].
1. Put them in order of what to secure first, starting with my email.
2. For each, tell me in plain steps how to turn on two-step login or a passkey and where to find the setting.
3. Remind me to turn on automatic updates for each device.
4. End with a one-page checklist I can tick off.
Never ask me for a password, code or account number, and remind me not to type them here.
Your turn: where's the needle for you?
Where's your AI panic level this week?
Add a comment if you like. We may run the best ones here, without your name.
Reader mail
From last week's panic poll.
Head for the bunker (9): “I just saw a headline that read: 'The AI-Hacking Apocalypse Began Last Night.' Seems like the end may be near.”
Headlines love an apocalypse. So do we, it's in the name. What actually changed is that break-ins got cheap, which means the boring locks matter more. Half an hour this weekend puts you behind most of them.
Head for the bunker (9): “These days I'm worried that one day we'll wake up and everyone's bank account will be empty. Also worried that something in the news will cause a run on the banks.”
Two different worries, two answers. A run on the banks: deposits at FDIC-insured banks are covered up to $250,000 per depositor, per bank, per ownership category if the bank fails. A thief emptying your account: that's what two-step login and account alerts are for, and if a transaction looks wrong, call the number on your card the same day.
One question for you: what's the AI thing that worried you, helped you or baffled you most this week? Tell us in a sentence or two → The best answers run here in a coming issue, without your name.
Know someone who'd find this useful? Forward it. That's how this thing grows. Or send them the link: survivingtheaiapocalypse.com/subscribe
Lock up, then enjoy the weekend,
The Levity Dept.
Researched with help from AI. Checked by grown-ups. Not legal, medical or financial advice. The full field guide and the Panic Meter history live at survivingtheaiapocalypse.com.