Everybody Can Hack Now

Summary

I rarely write news here. Daily incidents do not make evergreen posts. But something changed in cyber security this year, and it is not one vulnerability. It is that everybody can hack now. Give a language model a weak spot, or just a direction, and it finds the hole, and if you let it, the exploit. The question "why would they hack me?" has lost its meaning. Time to double down!

Full text

The scale is different this time

This week a critical vulnerability hit a programming language that runs a large part of the web. Matthew Prince, the CEO of Cloudflare, counted on X (22 October 2026): thousands of exploit attempts in the ten hours before the public announcement, tens of thousands in the 45 minutes after it, hundreds of thousands within two hours, millions by the next day. Jason Clinton, security chief at Anthropic, wrote the same day: go to your board now and ask for help, not for AI, for the basics.

Here is why I think this is more than one bad week. Most of the code on the internet has never been read by a machine that understands it. Many weaknesses stayed hidden because they are obscure, abstract or mathematical. A human needed real hacker skill, time and some luck to find one. A model has the patience and the sharpness to test far more attack vectors, on far more code, than any team of people. Bots and agents sweep the web systematically, at a scale and with a capability we have not seen before, and they get better every month. Nobody is too small to be found anymore.

Double down

There is no new trick. The basics have been the same for twenty years. What changed is the price of ignoring them.

• Stay current. Install security updates fast, automatically where you can. The window between an announcement and mass exploitation is now minutes, not weeks.
• Make backups. Offsite, rotated and encrypted. One copy is not a backup.
• Test your backups. Can you really restore? Do it, time it, and do it again next quarter.
• Reduce your attack surface. Fewer running parts, fewer public services, fewer pieces you do not control. Every plugin, every account and every service is a door.
• Assume the worst. What if all your data is stolen and made public tomorrow? Think it through today, and take what you can off the table up front. Data you do not need, you do not keep.
• Watch. Keep a strong, automated eye on your logs. The damage is decided by your response time to the first anomaly, not by the attack itself.

The DigiDef years

From 2015 to 2019 I did this work under its own name: DigiDef, a bureau for digital defence. Security audits of servers, websites and apps, backup audits before you really need them, source code reviews, and tracing how the hackers got in after the fact. Some of it I wrote up here: five easy tips to protect your server, the security concerns of shared hosting, ten tips for WordPress and, later, a backup rotation scheme. digidef.nl is offline now, but I found DigiDef's work so important that I made it an integral part of everything I do: websites that are generated in advance, with nothing running on the server that a visitor can talk to, servers with as few open doors as possible, logs that are read every night, and backups that get restored for real.

Hands on

This is how it looks in my own work. Since 2016 every website I build is generated in advance: the pages are made once, as files, and the server only hands them out. There is no application behind a visitor's request that can be talked into doing something it should not. That makes the sites faster and simpler, and it leaves very little to attack. Fewer moving parts is the whole idea.

All my servers send every log line to the platform's unified log system: about 1.7 million signals a day, sorted into kinds and counted per minute. Every morning a security round reads it, looking for the out-of-bound: kinds of lines never seen before, guessing pressure on mail and ssh, failed renewals, bans, a service answering errors. The same round checks each host against yesterday: pending security updates, open ports, users, keys, cron jobs, and the list of known vulnerabilities against what is actually installed. It only speaks up when something needs a hand.

Backups leave every night, off site, through a one-way door: the production machine decides what goes out, the receiving side cannot reach back in. Snapshots are taken after the copy by a separate account, so even a compromised sender cannot erase the history. Then an independent check walks the mirror from the outside, compares a sample byte for byte and reports a verdict. It has caught the backup reporting a false green more than once. Now and then I run a true disaster recovery scenario, as I did for one of my customers: start from the backups alone and bring the service back somewhere else. The gap you find that way, the one file the nightly copy never included, never shows up in a report that only says OK. And I stay in the loop with the people in Silicon Valley who build these models and defend against them; the two quotes above come from that loop.

A marathon, not a sprint

Nobody is safe. The more you know and understand about cyber security, the more you realise there is no quick fix. It is an ongoing effort, and it resembles a marathon much more than a sprint. You keep a pace you can hold, you look at the road ahead, you fix what you find today, and tomorrow you look again.

Conclusion

Cyber security stopped being a theoretical chance. Bots and agents sweep the web systematically, at a scale no human team can match, and they find what stayed hidden for years. The answer is not a new product. It is the basics, done well and done again: stay current, make backups and test them, run fewer parts, assume the worst, and watch your logs. Not sure where your doors are? Send me a message, I have been doing this for a long time. The bots are already running. Better lace up.