Monopoly Round-Up: What Happens When Cybersecurity Is Bad for Business

187

7

34

Share

Lots of monopoly-related news this week, as usual. The AI bubble continues to blow off steam, as even Elon Musk is saying the neoclouds are going bust, which BIG predicted a couple of weeks ago. And, as we race toward a consequential midterm election, Republican voters are demanding financial services reform, and a new Congressional report called “Settling for Less” is laying the foundation for oversight and accountability regarding the Trump Administration’s failed approach to antitrust enforcement.

Basically, the internet is being ruined by a massive new AI-fueled set of hacks, a situation nicknamed “Black October” by cybersecurity experts. Big or small, there’s a lot to unpack here and an opportunity to reflect on what this says about our failure to anticipate and govern for risk. Let’s dive in.

The situation we’re dealing with is not just a few more hacks here or there, but a step change in the vulnerability of everything. In the first six months of 2026, there were 3,494 successful cyber-attacks on financial institutions; and 16 hospitals in England shut down all non-critical operations because of a ransomware hack. Cybersecurity “may very well be the biggest threat to the U.S. financial system,” wrote JP Morgan CEO Jamie Dimon to shareholders.

The driver of the vulnerabilities is that AI systems make it so much easier to hack, lowering the cost for criminals and saboteurs to go after vulnerable systems. As cybersecurity expert Matthew Green put it, “We’re in the part of the movie where you need to throw whatever you can in the path of the zombies and hope it slows them down.” But just as important as the vulnerabilities, is the heated rhetoric around them, which are disguising the role of finance in helping to create the problem.

First, let’s get to why these hacks are different. The most notable penetration was of a web development tool called PHP, a server-side language used by roughly 70% of the world’s websites. The hacking of PHP is not a hack of a single service or a corporate network, it’s systemic. Now there is a mechanism for a large swath of people to go after hundreds of thousands or millions of institutions. As cybersecurity firm Wiz wrote, “Successful exploitation could allow attackers to take control of affected servers, steal sensitive data, and deface the websites running on them.”

I’m not a technologist, but a friend of mine provided a useful analogy: If you think of the internet as a restaurant, your browser is like the dining room, a server is like the kitchen that receives and sends out your order, there’s a pantry that’s basically a database with all sorts of sensitive info, and PHP is the chef that takes the order, mixes the ingredients, and sends out your meal. And when agents can exploit vulnerabilities in PHP and essentially take over its operations, it can throw the kitchen into chaos and start sending out very wrong orders.

It’s not just PHP, multiple core tools on top of which the internet is built are being poked full of holes. Here’s Jason Koebler of 404 Media:

In the last few days, major vulnerabilities or issues have been found in eMudhra (an Indian entity that provides website security certificates), Node.js (an alternative to PHP), Gitlab (a software development platform), Plex (media server software), Railway (a cloud provider), OpenCode (a coding agent platform), and several other companies and services, though, rightfully, none of these has gotten as much attention as the vulnerabilities in PHP, called PHP2Shell, which researchers from Wiz, Calif, and OpenAI discovered using AI.

The National Security Agency and equivalent national security agencies around the world have encouraged organizations to take certain websites offline while they patch them, which the governments of Germany, France, Australia, Netherlands, Japan, the United Kingdom have done.

Although I’m skeptical of catastrophizing about AI harms, this one is very real and bad. Aside from the ominous Black October label, the chief security officer at Anthropic is warning of a “vulnerability tsunami,” adding, “there won’t be enough time to patch critical infrastructure.” Critical infrastructure. OpenAI CEO Sam Altman joined the concern chorus, stating, “I no longer think we’re going to be able to patch all the bugs.”

And yet, there’s an important context here, and one that most of the people reporting breathlessly on Black October are leaving out. And that is, our cybersecurity regulatory model has been a deep structural risk for a really long time.

To make that point, I’ll note that I was actually lying in the first paragraph of this article. I wrote that there were 3,494 successful cyber-attacks on financial institutions in the first six months of 2026. Actually, that was the number in the first six months of 2019. UK hospitals shutting down, and of the quote from Jamie Dimon about cybersecurity being the biggest risk to our financial system, those also took place in 2019. Seven years ago.

Indeed, two years before that, in 2017, nearly a decade ago, hackers took control of Dallas’s tornado warning system and just kept waking people up.

Why does the longstanding nature of this problem matter? Well, because if the cybersecurity crisis existed before generative AI, then new AI hacking tools are not the sole driver of what’s going on.

A different narrative is as follows: The problem isn’t just that AI has made it easier to hack. It’s that Wall Street forces the use of software that is easy to hack because poorly written software is more profitable to sell.

Take a recent legal story about private equity firm Bain Capital. The company bought a company, PowerSchool, which had a severe and costly data breach. Bain, of course, had directed PowerSchool “to offshore cybersecurity, engineering, and IT functions to contractors,” which led to “data-management tools that enabled vendors to bypass consent protocols and access protected school district computers directly.” So there we go. Is the issue the savviness of hackers, or the business model of private equity?

Everyone in software knows the most profitable business model is to buy a company and slash spending on security. BIG has covered this dynamic since 2020, and the story is always the same. There’s a big hack, the reason is some sort of giant merger, followed by cuts to security and quality control spending, or offshoring. It became so routine BIG stopped writing about it.

For instance, there was “PE-owned SolarWinds that let hackers break in to large companies and the Federal government, including our nuclear weapons facilities,” as well as “PE-owned Pulse Connect Secure that let hackers take over New York subway systems,” and then PE-owned software firm Keseya, that cut R&D, offshored its software and testing development to Belarus, responsible for a major set of randomware attacks.

These stories are so common, and happen among big companies as well, like Microsoft or health insurers. Change Health, a United Health group company that was the lifeblood of medical payments, got hacked in 2024, meaning that doctors, hospitals, and pharmacies were starved of revenue for over a month. Similarly, it became impossible to buy a car in 2024 for a few weeks because of a randomware attack on the awful car dealer software monopolist CDK Global, which BIG covered. Both Change and CDK are merger and antitrust stories.

Major corporations from Twitter/X to Equifax to Uber have variously slashed their cybersecurity teams, removed cybersecurity evaluations from executive bonus compensation, and concealed evidence of massive data breaches. In 2016, Uber suffered a data breach involving 57 million users and 600,000 driver’s licenses. Rather than alert regulators, Uber’s chief security officer arranged a payment of $100,000 to hackers to keep news of the breach from regulators and users. He was ultimately convicted by a jury of obstructing justice and sentenced to three years probation.

Cybersecurity expert Bruce Schneier in 2021 laid out why corporations enable this fraud with weak cybersecurity controls. Their customers, he argued, just can’t tell the difference, until they are hacked.

The market encourages companies to make decisions in their private interest, even if that imperils the broader interests of society. [So] companies… save money by taking on greater risk and then pass off that risk to the rest of us, as individuals and as a nation.

The only way to force companies to provide safety and security features for customers and users is with government intervention. Companies need to pay the true costs of their insecurities, through a combination of laws, regulations and legal liability. Governments routinely legislate safety — pollution standards, automobile seatbelts, lead-free gasoline, food service regulations. We need to do the same with cybersecurity: The federal government should set minimum security standards for software and software development.

Schneier was right then, and he’s right now. There are all sorts of contexts in which we decide that some degree of mandatory government oversight is in the public’s best interest. Recently, a friend of mine got a new hot water heater installed in his house, and the city inspected it to ensure it was safe. Similarly, no one can just build a bridge based on vibes, civil engineering is a discipline with credentials, inspections, and a dense set of rules. As a result, no one is afraid of bridges or buildings falling down, and when it happens, it’s a really big deal. The Miami Beach Surfside building collapse is still major news, five years after it occurred.

That’s because these are systems that were organized before neoliberalism, when we governed and assessed risk. So the rules are clear and make sense, and the public expects well-structured engineering.

But after the 1980s, we mostly stopped managing risk, so when Bain Capital cut quality assurance for cybersecurity infrastructure that is equally important, no one bothered to report on it. When the hack happened, it barely made the papers. The cybersecurity crisis taking place this week didn’t come out of nowhere, it is the result of a deliberate choice not to manage risk and the resulting public expectations that hacks and scams cannot be reduced.

One reason the “AI is magic” narrative should be understood as half the story is because cybersecurity experts have been warning for decades of the problems created by building a society on top of bad sloppy code. Even the current problem shouldn’t be a surprise; experts have been warning about PHP vulnerabilities since the early 2000s. The vulnerabilities at the source of this week’s cybersecurity chaos were identified by researchers in 2024, then disregarded because the technology didn’t exist to make them exploitable. Well, now they are.

For decades, intelligent policymakers who saw the risks of vulnerable software sought to mandate corporate America patch its spaghetti-like IT systems, which have been made worse by endless merger waves in which operational problems got compounded. They also wanted the NSA to focus on defensive work instead of stockpiling hacks to use against foreign adversaries.

But that didn’t happen; the regulatory history on cybersecurity is exactly what you’d expect in an era when we refuse public utility rules on the powerful. Attempts to establish binding cybersecurity laws at the federal level have been prevented through the effective lobbying efforts of industry trade groups, and a broad lack of interest from progressives. For example, in 2013, Congress failed to pass comprehensive cybersecurity legislation. So President Obama issued an executive order called “Improving Critical Infrastructure Cybersecurity,” which directed federal regulators to survey existing cybersecurity requirements and for the National Institute of Standards and Technology, or NIST, to develop a cybersecurity framework in collaboration with