Does SI/AI Protect Us or Expose Us? The Real Truth About Cybersecurity
Painless Si/AI Lab – A Hong Kong Practitioner’s Real-World SI/AI Journey (Part 42):
Every few days the tech news warns that SI/AI will hack banks, crash power grids, break the internet or else. It is enough to make you want to turn the laptop off and go back to paper.
The useful question is smaller. Does SI/AI create security holes, or does it find the ones that were already there?
It finds them. It does not invent them.
The clearest recent case is PHP2Shell. PHP runs a large share of the web, including government sites and ordinary business sites. In August and September 2026, researchers at Calif, OpenAI, and Wiz used SI/AI tools to find two critical flaws in PHP itself. The bugs, CVE-2026-109618 and CVE-2026-109619, could let an attacker run code on an unpatched server without logging in. The patches landed on 21 October.
That is the double edge. SI/AI helped researchers find holes that had sat in the code for years. Once the details leaked, SI/AI also made it easier for attackers to adapt an exploit. Defense teams had to patch fast. Some sites went offline while they did.
For a lean business in Hong Kong, the lesson is not that SI/AI will protect you. It is that the weak point is still the unpatched site, the reused password, and the backup you never tested.
You do not need a security department. You do need three habits.
* Update the software that faces the public internet.
* Keep a backup that is not on the same server.
* Do not give an SI/AI tool access to live systems unless you know what it can change.
SI/AI is a fast diagnostic machine. It can show you the hole. It does not close it. The person who applies the patch, or who ignores it, still decides the outcome.
發佈留言