This story appeared in Today, Explained, a daily newsletter that helps you understand the most compelling news and stories of the day. Subscribe here.

Are we living through “Black October”? Maybe, according to cybersecurity experts who are raising the alarm about AI’s increasingly sophisticated and far-reaching hacking abilities. 

This week alone has seen a string of alarming incidents where AI uncovered previously unknown security flaws deep in the infrastructure of the internet. The most concerning involves something called PHP —  a programming language that, according to The Atlantic, is used by “as much as 70 percent of websites.” Cybersecurity researchers used AI to locate a major security breach in the technology.

It’s the kind of thing that, when it’s working, is practically invisible. When it stops, though, you really notice it: Government websites in the UK and Europe briefly went down earlier this week after the PHP vulnerability was discovered, as did some sites in the Wikipedia family, the Internet Archive, and many others.

The outages weren’t actually the result of a hack, but rather preventative action as web engineers took sites down to fix the vulnerability before it was exploited. But not every PHP-like issue will necessarily be uncovered before it can be exploited by someone using AI tools less ethically, and older websites relying on PHP might go unpatched. 

The problem doesn’t stop there, either: Concern is also rising around AI cybersecurity risks to ubiquitous conveniences like online banking. As Axios reported on Thursday, banks are detecting more and more “unauthorized third-party AI agents” operating inside of their systems. 

Those agents are mostly unauthorized by the banks, Axios explains — the holders of the bank account might have given them permission — but it still creates a security risk that executives described as “horrifying,” in part because banks can’t necessarily tell if an agent doesn’t have permission. 

It’s a lot to take in, all of it moving extremely quickly, and it’s hard to tell what any of us can do about it as AI labs continue to forge ahead with ever more competent AI models and agents. Luckily, my colleague Adam Clark Estes has some simple recommendations to shore up your own cybersecurity.

How do I respond right now?

One problem with hackers — even those that happen to be AI agents — is that they can be unpredictable. You won’t know to, say, lock down your Quest Diagnostics records before a breach happens. But whenever you find yourself wondering if your data is safe, that’s a good time to double check that you’ve at least covered your bases.

The National Cybersecurity Alliance, a nonprofit dedicated to the safe use of technology, maintains a list of basic online safety practices that everyone should follow. In no particular order, here’s what to pay attention to now:

1. Keep your guard up. AI makes it difficult to know the difference between humans and robots. It’s a fact of life in the year 2026. So be extra careful to avoid engaging in potential phishing scams. Don’t reply to unknown texts, and do due diligence on texts or emails that look like they’re from people you know but just seem off. Don’t click weird links. Don’t give out personal info over the phone, even if it sounds like it’s someone you know. They might be scammers using AI to clone a loved one’s voice.
2. Update your software. Yes, it’s annoying to pause your phone or computer use for a few minutes to update your software, but this is one of the best ways to get rid of vulnerabilities. Companies like Apple and Google employ huge teams of security experts to spot these in their software and fix them with software updates. Do the updates.
3. Use a password manager or, even better, passkeys. Each of your online accounts should have a unique password that’s at least 16 characters. Yes, it’s impossible to remember that many passwords, so you should also use a password manager like 1Password or the app built into your iPhone or Android device.
4. Turn on multifactor authentication. Just in case you don’t already do it, make sure you use multifactor or two-step authentication for all your accounts, including email and social media. It can be annoying to type in a code or check your email while logging in, but hackers, including AI agents, will have a much harder time getting into your accounts if you take this step.

Taking all these measures is not a one-time affair. You have to be vigilant in keeping yourself safe online. Security experts have a term for this that’s almost too specific: cyber hygiene. Like brushing your teeth or taking a shower, take good care of your online life, and do it often.

One link for later

➨ Is it still possible to ban gerrymandering? The current US Supreme Court is very, very hostile to getting politics out of congressional map-making. But if Democrats win back power, that doesn’t mean they shouldn’t try. My colleague Ian Millhiser gamed out how they could do it in a way that survives the Court — as well as some approaches that almost certainly wouldn’t fly. But, he writes, the real trick will be finding a solution that functions the way Congress wants it to and can’t be exploited by mapmakers.

Before you go…

• Did you know…that the disease multiple sclerosis is misdiagnosed with surprising frequency? As many as 15 percent of diagnoses could be false positives — including that of Christina Applegate, who found out this week that she does not have MS despite a 2021 diagnosis.
• Today’s trivia: Which noble gas is radioactive and has the chemical symbol Rn? (You can find this and other brain puzzles in Vox’s daily crossword. Look for the answer in Monday’s edition.)
• Yesterday’s trivia: We asked what the plural was for multiple Toyota hybrids. That would be Prii, which Toyota officially confirmed in 2011 after holding a vote.

This story appeared in Today, Explained, a daily newsletter that helps you understand the most compelling news and stories of the day. Subscribe here.

The last US troops in Iraq formally withdrew today, 23 years after the United States first invaded Iraq and 12 years after it returned to take on the Islamic State. It’s a historic occasion, by many accounts — but also a pretty low-key one: The US has steadily scaled back its presence in Iraq for years as part of a phased drawdown inked by the Biden administration. 

That drawdown represents the end of a long (and often, ugly) chapter in US military history. The US and its allies deployed tens of thousands of troops to Iraq as part of the larger war on terror that started in 2003. 

Those troops left Iraq in 2011. But a smaller contingent returned three years later to stamp out the Islamic State, a violent jihadist group that had gained a major foothold after Western forces left the country. 

Neither campaign was particularly popular with the American public in the end, and more than 4,500 Americans have died in Iraq in the past 20 years. Large numbers of civilian casualties, as well as drone strikes that were seen as violations of Iraq’s sovereignty, have also fueled periodic Iraqi protests against American intervention. 

As the US withdraws, however, it’s leaving behind some very loose ends. Loose ends that, as we’ll see in a minute, ultimately benefit…Iran.

Go a little deeper

Don’t quite believe me? Just look at how Iran’s allies are celebrating today’s news. The commander of one Iranian-backed militia in Iraq called the withdrawal “a crushing defeat for the American project.”

Both Iran and the United States have spent the past 23 years attempting to shape the new Iraq. Historically, Iran and Iraq were bitter rivals — an enmity probably best demonstrated by Saddam Hussein’s 1980 invasion of Iran. 

After the US toppled Hussein in 2003, however, Tehran redoubled its efforts to build political and military clout in the new Iraqi state. It strengthened ties with figures like Hadi al-Amiri, whose Iran-backed Badr Organization has become a major force in Iraqi politics. It poured hundreds of millions of dollars into soft-power projects, like expanding Shiite pilgrimage sites in Iraq. And it funded, equipped, and trained a number of powerful paramilitary groups.

Some analysts have warned that the final withdrawal of US troops could embolden Iranian-linked groups in Iraq. That also seems to be a concern on the ground, where ordinary Iraqis have told reporters they fear their country “could be swallowed up” by groups linked to Iran.  

Already, the Iraqi government has pushed back the deadline for Iranian-backed militia groups to disarm. It was originally supposed to happen on the official date of the US withdrawal — today.

It’s an inglorious ending, all told — and a sobering lesson on the limits of American power. The US may have the resources to handily win any military spat it gets itself into. But securing a desired political outcome is a different and more time-consuming project altogether.

It doesn’t help that US rivals like Iran seem very willing to play the long game. By dipping in and out of places like Iraq, the US may risk giving Tehran more openings. 

One link for later

➨ Don’t throw out that old receipt! It — along with the political mailers, ticket stubs, business cards, product packaging, and other printed ephemera you encounter in your day — is perfectly suited to the newly viral hobby of junk journaling. It can be a powerful creative practice and the ideal antidote to doomscrolling.

Before you go…

• Did you know…that your sense of touch peaks in your late teenage years, and declines gradually from there? It might be one of the reasons that elderly people are prone to falls.
• Today’s trivia: Where was Napoleon exiled to after his forced abdication? (You can find this and other brain puzzles in Vox’s daily crossword. Look for the answer in tomorrow’s edition.)
• Yesterday’s trivia: We asked you for the origin story of civil rights icon Ruby Bridges. She was the first Black child in the American South to attend an all-white elementary school, and she went on to start a foundation devoted to tolerance.