Fake is the New Black Update

Fake is the New Black (And Widespread Infrastructure Outages are the New Reality)

Looking back at Monday, February 19, 2024—which feels like geologic time by AI standards—I wrote an urgent warning about rapid AI advances making scammers significantly more dangerous (Trower, 2024). Back then, the headline threat was the first-of-its-kind $25 million deepfake heist where a company employee was duped into an entire virtual video call with a faked CFO and colleagues (Edwards, 2024).

I warned back then that if you don't know for sure that it's real, you must assume it's a scam (Trower, 2024). That our default condition has to shift to zero-trust because AI could instantly clone voices, defeat banking biometrics, and profile your emotional weaknesses in a ten-second audio clip.

But looking at it today, the threat vector has evolved into something even more predictable and vastly more devastating.

We just witnessed the "php2shell" emergency, where critical vulnerabilities (CVE-2026-109618 and CVE-2026-109619) exposed over 1.5 million servers and pulled down roughly 70% of the public internet in a cascade of panic (Sherlock Forensics, 2026; Wiz, 2026). The NSA, FBI, and global cybersecurity leaders had to issue emergency advisories urging immediate mitigations and offline isolations (ANI News, 2026; Cybersecurity and Infrastructure Security Agency [CISA], 2026). Government portals, massive transit networks, and cornerstone platforms like Wikipedia and Archive.org went completely dark. It wasn’t just a breach; it was a structural collapse.

What makes this recent meltdown so terrifying—and what connects it directly to my warnings from 2024—is how AI has transformed the lifecycle of a security flaw.

When a structural vulnerability is uncovered today, we no longer have weeks or months of a "responsible disclosure" window. Threat intelligence confirms that autonomous agentic frameworks and AI engines can instantly weaponize a newly discovered leak, scanning millions of servers and generating exploitation scripts in fractions of a second (CrowdStrike, 2026; Google Threat Intelligence Group [GTIG], 2026). The moment a crack appears in the infrastructure, it is instantly capitalized upon at a scale no human team can defend against in real-time.

Yet, despite this warp-speed threat landscape, the powers that be in finance and telecommunications continue to be scarily lax. They remain entrenched in ancient infrastructure while spending their real engineering efforts positioning themselves for "plausible deniability."

Instead of building resilient, modern safeguards, corporate policy is designed to ensure that when a catastrophic failure inevitably occurs, the system defaults to blaming the customer. Lose your life savings to a hyper-realistic AI voice clone or a massive corporate credential leak? Their response is a shrug and a corporate script telling you that you should have been more careful.

Back in 2024, I told you to update passwords and enforce 2-factor authentication because scammers were tailoring strategies to fool you personally (Trower, 2024). Today, the game is even bigger. You aren't just defending against a clever bot phishing for your password; you are operating on an internet where the entire underlying foundation can be yanked offline in a single Wednesday afternoon.

Until corporate and infrastructure security catches up to the r
ealities of instantaneous AI exploitation, you cannot rely on the institutions that hold your data or your money to protect you. Their default is to protect their own liabilities. Your default must remain absolute skepticism.

References

ANI News. (2026, October 22). 'Update PHP or go offline': Japan PM, FBI warns organizations as major websites go dark ahead of critical cybersecurity update. ANI News. https://www.aninews.in/news/world/asia/update-php-or-go-offline-japan-pm-fbi-warns-organizations-as-major-websites-go-dark-ahead-of-critical-cybersecurity-update20261022052137

CrowdStrike. (2026, October 21). CrowdStrike uncovers new agentic AI campaigns. CrowdStrike Counter Adversary Operations. https://www.crowdstrike.com/en-us/blog/crowdstrike-uncovers-new-agentic-ai-campaigns/

Cybersecurity and Infrastructure Security Agency. (2026, October 21). Critical vulnerabilities in PHP require immediate patching (Alert No. 2026-10-21). U.S. Department of Homeland Security. https://www.cisa.gov/news-events/alerts/2026/10/21/critical-vulnerabilities-php-require-immediate-patching

Edwards, B. (2024, February 5). Deepfake scammer walks off with $25 million in first-of-its-kind AI heist. Ars Technica. https://arstechnica.com/information-technology/2024/02/deepfake-scammer-walks-off-with-25-million-in-first-of-its-kind-ai-heist/

Google Threat Intelligence Group. (2026, May 11). Adversaries leverage AI for vulnerability exploitation, augmented workflows, and initial access. Google Cloud Threat Intelligence. https://cloud.google.com/blog/topics/threat-intelligence/ai-vulnerability-exploitation-initial-access

Sherlock Forensics. (2026, October 21). PHP2Shell (CVE-2026-109618/109619) incident response: Out-of-memory corruption and stale global state across requests. https://www.sherlockforensics.com/blog/cve-2026-109618-cve-2026-109619-php2shell-php-rce.html

Trower, B. (2024, February 19). Fake is the new black. The Deep North. https://blog.bobtrower.com/2024/02/fake-is-new-black.html

Wiz. (2026, October 21). PHP2Shell—AI uncovers critical vulnerabilities in the backbone of the web (CVE-2026-109618 & CVE-2026-109619). Wiz Threat Intel Center. https://www.php2shell.com/