BURSTLots of monopoly-related news this week, as usual. The AI bubble continues to blow off steam, as even Elon Musk is saying the neoclouds are going bust, which BIG predicted a couple of weeks ago. And, as we race toward a consequential midterm election, Republican voters are demanding financial services reform, and a new Congressional report called “Settling for Less” is laying the foundation for oversight and accountability regarding the Trump Administration’s failed approach to antitrust enforcement.
But before we get to all of that, which is below for paid subscribers, you may have seen a lot of chatter last week about a wave of AI-enabled cybersecurity failures that resulted in the preemptive takedown of government websites around the world. The effects were also local and diffuse. I was talking about this with a friend who said the platform for coordinating his kid’s soccer league was shut down for a couple of days, leaving parents in the lurch on upcoming schedules.
Basically, the internet is being ruined by a massive new AI-fueled set of hacks, a situation nicknamed “Black October” by cybersecurity experts. Big or small, there’s a lot to unpack here and an opportunity to reflect on what this says about our failure to anticipate and govern for risk. Let’s dive in.
A Cybersecurity Comeuppance
The situation we’re dealing with is not just a few more hacks here or there, but a step change in the vulnerability of everything. In the first six months of 2026, there were 3,494 successful cyber-attacks on financial institutions; and 16 hospitals in England shut down all non-critical operations because of a ransomware hack. Cybersecurity “may very well be the biggest threat to the U.S. financial system,” wrote JP Morgan CEO Jamie Dimon to shareholders.
The driver of the vulnerabilities is that AI systems make it so much easier to hack, lowering the cost for criminals and saboteurs to go after vulnerable systems. As cybersecurity expert Matthew Green put it, “We’re in the part of the movie where you need to throw whatever you can in the path of the zombies and hope it slows them down.” But just as important as the vulnerabilities, is the heated rhetoric around them, which are disguising the role of finance in helping to create the problem.
First, let’s get to why these hacks are different. The most notable penetration was of a web development tool called PHP, a server-side language used by roughly 70% of the world’s websites. The hacking of PHP is not a hack of a single service or a corporate network, it’s systemic. Now there is a mechanism for a large swath of people to go after hundreds of thousands or millions of institutions. As cybersecurity firm Wiz wrote, “Successful exploitation could allow attackers to take control of affected servers, steal sensitive data, and deface the websites running on them.”
I’m not a technologist, but a friend of mine provided a useful analogy: If you think of the internet as a restaurant, your browser is like the dining room, a server is like the kitchen that receives and sends out your order, there’s a pantry that’s basically a database with all sorts of sensitive info, and PHP is the chef that takes the order, mixes the ingredients, and sends out your meal. And when agents can exploit vulnerabilities in PHP and essentially take over its operations, it can throw the kitchen into chaos and start sending out very wrong orders.
It’s not just PHP, multiple core tools on top of which the internet is built are being poked full of holes. Here’s Jason Koebler of 404 Media:
In the last few days, major vulnerabilities or issues have been found in eMudhra (an Indian entity that provides website security certificates), Node.js (an alternative to PHP), Gitlab (a software development platform), Plex (media server software), Railway (a cloud provider), OpenCode (a coding agent platform), and several other companies and services, though, rightfully, none of these has gotten as much attention as the vulnerabilities in PHP, called PHP2Shell, which researchers from Wiz, Calif, and OpenAI discovered using AI.
The National Security Agency and equivalent national security agencies around the world have encouraged organizations to take certain websites offline while they patch them, which the governments of Germany, France, Australia, Netherlands, Japan, the United Kingdom have done.
Although I’m skeptical of catastrophizing about AI harms, this one is very real and bad. Aside from the ominous Black October label, the chief security officer at Anthropic is warning of a “vulnerability tsunami,” adding, “there won’t be enough time to patch critical infrastructure.” Critical infrastructure. OpenAI CEO Sam Altman joined the concern chorus, stating, “I no longer think we’re going to be able to patch all the bugs.”
Private Equity Offshored Our Software Security
And yet, there’s an important context here, and one that most of the people reporting breathlessly on Black October are leaving out. And that is, our cybersecurity regulatory model has been a deep structural risk for a really long time.
To make that point, I’ll note that I was actually lying in the first paragraph of this article. I wrote that there were 3,494 successful cyber-attacks on financial institutions in the first six months of 2026. Actually, that was the number in the first six months of 2019. UK hospitals shutting down, and of the quote from Jamie Dimon about cybersecurity being the biggest risk to our financial system, those also took place in 2019. Seven years ago.
Indeed, two years before that, in 2017, nearly a decade ago, hackers took control of Dallas’s tornado warning system and just kept waking people up.
Why does the longstanding nature of this problem matter? Well, because if the cybersecurity crisis existed before generative AI, then new AI hacking tools are not the sole driver of what’s going on.
A different narrative is as follows: The problem isn’t just that AI has made it easier to hack. It’s that Wall Street forces the use of software that is easy to hack because poorly written software is more profitable to sell.
Take a recent legal story about private equity firm Bain Capital. The company bought a company, PowerSchool, which had a severe and costly data breach. Bain, of course, had directed PowerSchool “to offshore cybersecurity, engineering, and IT functions to contractors,” which led to “data-management tools that enabled vendors to bypass consent protocols and access protected school district computers directly.” So there we go. Is the issue the savviness of hackers, or the business model of private equity?
Everyone in software knows the most profitable business model is to buy a company and slash spending on security. BIG has covered this dynamic since 2020, and the story is always the same. There’s a big hack, the reason is some sort of giant merger, followed by cuts to security and quality control spending, or offshoring. It became so routine BIG stopped writing about it.
For instance, there was “PE-owned SolarWinds that let hackers break in to large companies and the Federal government, including our nuclear weapons facilities,” as well as “PE-owned Pulse Connect Secure that let hackers take over New York subway systems,” and then PE-owned software firm Keseya, that cut R&D, offshored its software and testing development to Belarus, responsible for a major set of randomware attacks.
These stories are so common, and happen among big companies as well, like Microsoft or health insurers. Change Health, a United Health group company that was the lifeblood of medical payments, got hacked in 2024, meaning that doctors, hospitals, and pharmacies were starved of revenue for over a month. Similarly, it became impossible to buy a car in 2024 for a few weeks because of a randomware attack on the awful car dealer software monopolist CDK Global, which BIG covered. Both Change and CDK are merger and antitrust stories.
Major corporations from Twitter/X to Equifax to Uber have variously slashed their cybersecurity teams, removed cybersecurity evaluations from executive bonus compensation, and concealed evidence of massive data breaches. In 2016, Uber suffered a data breach involving 57 million users and 600,000 driver’s licenses. Rather than alert regulators, Uber’s chief security officer arranged a payment of $100,000 to hackers to keep news of the breach from regulators and users. He was ultimately convicted by a jury of obstructing justice and sentenced to three years probation.
Cybersecurity expert Bruce Schneier in 2021 laid out why corporations enable this fraud with weak cybersecurity controls. Their customers, he argued, just can’t tell the difference, until they are hacked.
The market encourages companies to make decisions in their private interest, even if that imperils the broader interests of society. [So] companies… save money by taking on greater risk and then pass off that risk to the rest of us, as individuals and as a nation.
The only way to force companies to provide safety and security features for customers and users is with government intervention. Companies need to pay the true costs of their insecurities, through a combination of laws, regulations and legal liability. Governments routinely legislate safety — pollution standards, automobile seatbelts, lead-free gasoline, food service regulations. We need to do the same with cybersecurity: The federal government should set minimum security standards for software and software development.
Schneier was right then, and he’s right now. There are all sorts of contexts in which we decide that some degree of mandatory government oversight is in the public’s best interest. Recently, a friend of mine got a new hot water heater installed in his house, and the city inspected it to ensure it was safe. Similarly, no one can just build a bridge based on vibes, civil engineering is a discipline with credentials, inspections, and a dense set of rules. As a result, no one is afraid of bridges or buildings falling down, and when it happens, it’s a really big deal. The Miami Beach Surfside building collapse is still major news, five years after it occurred.
That’s because these are systems that were organized before neoliberalism, when we governed and assessed risk. So the rules are clear and make sense, and the public expects well-structured engineering.
But after the 1980s, we mostly stopped managing risk, so when Bain Capital cut quality assurance for cybersecurity infrastructure that is equally important, no one bothered to report on it. When the hack happened, it barely made the papers. The cybersecurity crisis taking place this week didn’t come out of nowhere, it is the result of a deliberate choice not to manage risk and the resulting public expectations that hacks and scams cannot be reduced.
What If Bridges Constantly Fell Down?
One reason the “AI is magic” narrative should be understood as half the story is because cybersecurity experts have been warning for decades of the problems created by building a society on top of bad sloppy code. Even the current problem shouldn’t be a surprise; experts have been warning about PHP vulnerabilities since the early 2000s. The vulnerabilities at the source of this week’s cybersecurity chaos were identified by researchers in 2024, then disregarded because the technology didn’t exist to make them exploitable. Well, now they are.
For decades, intelligent policymakers who saw the risks of vulnerable software sought to mandate corporate America patch its spaghetti-like IT systems, which have been made worse by endless merger waves in which operational problems got compounded. They also wanted the NSA to focus on defensive work instead of stockpiling hacks to use against foreign adversaries.
But that didn’t happen; the regulatory history on cybersecurity is exactly what you’d expect in an era when we refuse public utility rules on the powerful. Attempts to establish binding cybersecurity laws at the federal level have been prevented through the effective lobbying efforts of industry trade groups, and a broad lack of interest from progressives. For example, in 2013, Congress failed to pass comprehensive cybersecurity legislation. So President Obama issued an executive order called “Improving Critical Infrastructure Cybersecurity,” which directed federal regulators to survey existing cybersecurity requirements and for the National Institute of Standards and Technology, or NIST, to develop a cybersecurity framework in collaboration with the private sector.
But the industry, fearing the project would result in mandatory cybersecurity regulations, emphasized the adequacy of existing cybersecurity systems. So, in 2014, when NIST issued its Framework 1.0, it established guidance that was entirely voluntary. The Information Technology Industry Council (ITI), which represents pretty much every major tech company under the sun, publicly supported the framework but continued to lobby against any further development of mandatory regulations. Unsurprisingly, when Congress finally passed the Cybersecurity Act of 2015, it maintained a voluntary cyber-threat information sharing framework. And in 2016, when the FCC adopted new mandatory rules, Congress responded by repealing them.
As of October 2026, the debate over a comprehensive, binding cybersecurity framework rages on. Congress enacted the Cyber Incident Reporting for Critical Infrastructure Act in 2022, requiring CISA to establish reporting rules for covered cyber incidents and ransom payments. It was hailed as an “important milestone.” Four years later, the final rule remains under review.
That’s not to say that companies can’t be held accountable, and on Friday, former FTC Chair Lina Khan weighed in with a statement far more forceful than anyone currently in government.
But of course, Khan has been an outlier, and certainly no one fears any enforcement from the Trump administration along these lines.
I haven’t given a comprehensive review of the policy problem, but you get the point. What is effectively a public utility-style regulatory of core infrastructure has been off the table since business software went mainstream in the 1980s. And now we’re reaping the whirlwind.
Office Space
There’s a pattern here that serves as a referendum on the pursuit of quick financial gains at the expense of taking steps to safeguard the public. And that’s no different with this AI crisis. What’s happened is the concerns of IT professionals, like those of all workers, have been marginalized for decades because addressing those concerns is bad for finance.
Among the many tech voices speaking up right now are researchers at a company called Wiz, which referred to this week’s events as “among the most severe vulnerabilities discovered in PHP, and arguably in software history.” Wiz was acquired by Google earlier this year for $32 billion, and while it continues to provide service to other Big Tech companies, the effect of coming under the Alphabet umbrella is that Google now bottlenecks cybersecurity for much of the internet.
So yes, AI has made hacking a lot easier, and that’s a crisis. It may indeed destroy some parts of the internet. But if we had an institutional infrastructure where we could govern and manage risk, we might be able to get a hold on it. Maybe the crisis will actually force such a reckoning. I mean, the CEO of Hugging Face, which was the hack that kicked off the current discourse, has encouraged real cybersecurity regulation.
All that said, whatever happens with AI, realize there is no addressing cybersecurity without spending more money on risk management, which means lowering returns on capital across corporate America. And that’s the real problem that no one in Silicon Valley or Wall Street wants to admit.
Now, on to the Good and Bad news of the week, including a penalty for Meta that even Mark Zuckerberg might notice, a huge surveillance pricing merger involving one of the largest advertising holding companies in the world, and a merger that could result in an $824 billion payday for the richest man in the world.
All of that and much more for paid subscribers only, after the jump.