Topic
Security stories rarely end when the headline fades. A worm that spread in an afternoon can shape email filtering for a decade, and a court case about copy protection can still decide what you are allowed to do with a file you bought.
These explainers follow the incidents and arguments that defined internet security, from the mass-mailing worms of the early 2000s and the profit-driven botnets that replaced them to today’s AI-assisted bug hunting and the October 2026 PHP2Shell and eMudhra incidents.
In October 2026 two critical memory-safety bugs in PHP itself, CVE-2026-109618 and CVE-2026-109619, leaked before the fix was ready. They let an attacker with no account run code on servers running PHP versions going back to 5.4.
In October 2026 a researcher showed that eight intermediate certificate authority keys belonging to India’s eMudhra were so weak they could be recovered in under a second. Browsers blocked them within hours, and eMudhra quit the global TLS certificate business.
AI models now find serious flaws in core internet software, and attackers use the same tools to exploit them within hours. What October 2026’s run of disclosures shows about the risks, and what defenders can do.
In January 2007 an email about deadly storms in Europe spread a Trojan that built one of the largest peer-to-peer botnets of its time.
In February 2001 an email promising a photo of the tennis player spread worldwide. It was built with a point-and-click virus generator.
In December 2006 Bill Gates said digital rights management caused too much pain for honest buyers, at a time when Microsoft was selling DRM technology.
In February 2005 the address book and notes from Paris Hilton’s T-Mobile Sidekick appeared online. The breach showed how weak account recovery could expose data synced to the cloud.
The Digital Millennium Copyright Act banned breaking copy protection and created notice-and-takedown. Both rules have been controversial ever since.
In May 2000 an email titled “ILOVEYOU” spread from the Philippines to tens of millions of computers in days, overwriting files and flooding mail servers.
In January 2004 Mydoom spread by fake bounced-email messages, opened a backdoor on infected PCs, and used them to attack SCO’s website.
In July 2001 the Code Red worm infected hundreds of thousands of Microsoft web servers in a day, defacing pages and aiming a flood of traffic at whitehouse.gov.
Estimate how hard a password is to guess. Everything runs locally; nothing is sent anywhere.
Calculate SHA-256, SHA-1 or SHA-512 checksums for a file and compare them with a published value.