When a Major Internet Bug Hits, Change Your Passwords and Update Everything
Basic hygiene matters most as AI helps find flaws faster than fixes can keep up.
Up First from NPR · Websites Go Offline, Protests in France, Netflix DownsizesKevin Roose, who co-hosts Machine Gods, a show about artificial intelligence, spends his time talking to people in the security industry. His advice for the rest of us when a big internet flaw makes news is unglamorous, and deliberately so: check your own security now.
The latest scare shows why. Researchers recently found a bug in PHP, decades-old software that powers about seven in ten websites. Roose said it "had two flaws that would let someone take over any computer that was running a website without a password and without leaving any fingerprints." Researchers used AI to discover the hole, and Roose said AI tools can now also quickly exploit holes like that once they are public.
For individuals, Roose laid out three basic moves. First, change your passwords if you have not rotated them in a while, and make them unique from site to site. Second, use a password manager to keep track of them. Third, install the latest updates on your phones and computers.
Roose said, "I don't think it's time to panic for most people," but he added a warning for anyone who runs a small website, or whose organization has not checked its security in a while. For them, he said, this is crunch time, because new patches and fixes for these vulnerabilities must be added fast.
People he talks to anticipate roughly two years where a fresh emergency arrives weekly as automated tools scan wider stretches of the web to find what is broken or missing or open. If that sounds exhausting, start with the passwords you have not changed in a while.
Questions people ask
What does a password manager actually do?
A password manager is an app that creates, stores, and fills in long, unique passwords for each site, so you only have to remember one master password. Most run on phones and computers and sync between them, and many reputable options cost a few dollars a month, with free versions available. It does not make you immune to breaches, but it makes password reuse much less likely.
How do I update my devices properly?
On phones, tablets, and computers, install system updates and browser updates as soon as they are offered, and turn on automatic updates where you can. Also update apps, routers, and smart devices, restarting after the update so the fix takes effect. For a website owner, updating also means applying the latest version of server software like PHP through your host or administrator.
How often should I change passwords now?
Experts no longer recommend forced changes every 30 or 90 days, which tended to produce weaker passwords. The current guidance is to use a long, unique password for each important account, store it in a password manager, and change it promptly if there is a breach or a major bug announcement. Add two-factor authentication on email, banking, and social accounts for extra protection.