AI is exposing how fragile the web really is. What you can do to stay safe

The vulnerabilities were around for years — more than a decade — but researchers were only able to understand how hackers could take advantage of them with the help of AI.

The vulnerability, called P2PShell, impacts a coding language that powers 70 percent of the world’s websites, enabling hackers to remotely execute code or gain access to information stored on servers. That sent websites into a scramble to update their systems, with some government websites in Europe going offline temporarily this past week until they could install the fix.

The discovery is yet another reminder of the fragile infrastructure of the internet. And with AI supercharging the abilities of both researchers and bad actors to discover flaws, it likely won’t be the last time a discovery like this is made.

“A lot of the internet and a lot of global IT infrastructure runs on technology that’s quite old, or is based on things that are very old in terms of computers, and likely have similar vulnerabilities,” said Patrick Fussell, IBM’s global head of adversary simulation.

With a vulnerability like P2PShell, there isn’t much that users can do to protect themselves. It’s up to organizations, businesses and governments to update their services with the latest security patches.

But it does underscore the importance of being smart about your digital habits. The age-old advice of keeping your passwords secure and being wary of suspicious emails is more important than ever as hackers gain more sophisticated tools and use AI to find more of the internet’s weak points.

Don’t ignore those software update notifications on your laptop or phone. Many of these updates include critical security fixes, and installing them as quickly as possible shortens the amount of time hackers have to take advantage of bugs.

“Users still need to do their parts in terms of installing those updates and maintaining a good security hygiene to put them in a slightly better position,” said Gang Wang, associate professor of computer science at the University of Illinois.

Most smartphones now support software updates for roughly seven years following their release. If you have an older phone, you should check if it’s still compatible with new software versions. You can find information about software compatibility on Apple, Google and Samsung’s websites.

Pay attention to the URLs of websites you’re visiting and links you’re clicking, especially if you’ve received the link in an email or text claiming to be your bank or credit card company. Never share personal data, email addresses, passwords, banking information or credit card numbers unless you’re certain the website is legitimate.

AI has enabled attackers to create sophisticated phishing attacks that are more difficult to spot and may lack the key red flags of a scam.

“The traditional way of determining a phishing attack was, ‘Hey, it didn’t sound right. It used wrong language. It had spelling errors, grammar errors,’” Jud Dressler, head of the risk operations center at cyber insurance firm Resilience, previously told CNN. “All of that stuff, the AI is going to take care of that.”

AI can also help attackers conduct deeper research on potential targets to create more personalized and convincing messages, Dressler added.

The best way to avoid phishing scams is to log into your account or call the company or person you’ve received a suspicious message from, rather than clicking links.

Also, remember that smaller businesses may be slower to patch their systems in the event of an attack or data breach compared to large companies.

Never reuse passwords. Instead, try a password manager that creates long, unique passwords for all your online accounts.

Simply put: Computers are better than humans at making passwords that are hard to guess.

“We know humans, when they make decisions, they tend to make the same decisions as other people,” Rachel Tobac, CEO of cybersecurity and training company SocialProof Security, told CNN’s Terms of Service podcast with Clare Duffy in 2024. “So, you know, they make a password for their work. It has the work’s name in it. It’s got a capital letter in the first position to satisfy the capitalization requirement.”

Tobac recommended password managers like Bitwarden, 1Password and Dashlane. The most important thing to look for is whether a password manager offers encryption, which keeps your passwords safe and unreadable to hackers.

Use passkeys instead of passwords: Passkeys are digital credentials that let you sign into online services using your fingerprint, face scan or PIN instead of a typed password. Passkeys are generally thought to be more secure than passwords since they’re tied to biometric data stored on your device that can’t be as easily stolen or spoofed. Apple, Google and Microsoft’s operating systems all support passkeys.

Use two-factor authentication: Enable two-factor verification on any service that offers it. Two-factor authentication sends a login code via text, email or phone call as an extra layer of protection in addition to your password. Some experts prefer app-based code generators like Google Authenticator since text messages can be vulnerable to hackers.

Monitor all your important accounts: Keep an eye on all important accounts for suspicious changes. Many offer automatic email or text alerts.

Freeze your credit report: Freezing your credit file with the three main agencies — Experian, Transunion and Equifax — is an easy way to prevent nefarious actors from trying to open new accounts in your name.

Create a family code word: If you get a suspicious call or message from someone who sounds like a loved one asking for information, call them back yourself, or call people close to them if you can’t get a hold of them. A code word shared between you and your loved ones can confirm their identity.

While AI is making it easier for even novice hackers to execute more advanced campaigns, bad actors are still trying to take advantage of humans at the end of the day.

“It’s still kind of a familiar attack method,” said Dressler. “It’s just using essentially AI to make it more believable and more effective.”