AI just cracked open a vulnerability that's been sitting in plain sight for over a decade, and it affects 70% of the world's websites. The flaw, called P2PShell, lets hackers remotely execute code or raid server data—and European government sites already went offline this past week scrambling to patch it. For ordinary Americans, this means the infrastructure you rely on for banking, health records, and basic communication is held together by digital duct tape, and the same Big Tech oligarchs who centralized it will be first in line to sell you the subscription fix.
The irony is brutal. Researchers needed AI to fully understand how bad actors could exploit P2PShell—but that same AI is now weaponized in attackers' hands too. "A lot of the internet and a lot of global IT infrastructure runs on technology that's quite old, or is based on things that are very old in terms of computers, and likely have similar vulnerabilities," Patrick Fussell, IBM's global head of adversary simulation, told CNN. Translation: the internet's foundation is geriatric code, and nobody with power cared until AI made the threat impossible to ignore.
ABC17News framed this as a personal responsibility story—update your phone, watch for phishing, use better passwords. That's not wrong, but it's woefully incomplete. Gang Wang, an associate professor of computer science at the University of Illinois, told CNN that users need to "install those updates and maintain good security hygiene." Fine. But when a vulnerability impacts 70% of the web, individual hygiene is rearranging deck chairs. The real problem is structural: a handful of corporations consolidated the internet's architecture into a brittle, interdependent mess, and now they'll pitch cloud security and enterprise AI as the cure.
AI has also supercharged phishing beyond recognition. The old tells—bad grammar, weird phrasing—are gone. "The traditional way of determining a phishing attack was, 'Hey, it didn't sound right. It used wrong language. It had spelling errors, grammar errors,'" Jud Dressler, head of the risk operations center at cyber insurance firm Resilience, told CNN. "All of that stuff, the AI is going to take care of that." Attackers can now research targets and craft personalized scams at scale. The average American doesn't stand a chance against that kind of automation.
XDA Developers, for its part, spent its ink on Google Maps features—an apt illustration of where the tech press's priorities lie. While the web's load-bearing walls are cracking, the coverage defaults to app tips and ecosystem cheerleading.
The open question is whether this scares anyone straight. P2PShell won't be the last AI-discovered flaw, and patching this one doesn't fix the rot underneath. Decentralization and open protocols—architecture no single company can hold hostage—are the structural answer. Everything else is a subscription waiting to happen.
