When Nothing Stays Hidden

For thirty years, a spare key to the back door of a farmhouse lay under the third flowerpot from the left. Everyone in the family knew it. Nobody thought of it as a risk, because the house stood at the end of a long road and nobody ever came down it.

Then the road changed. Imagine a patrol that never tires, never sleeps and costs almost nothing to run, walking every road in the country and trying every flowerpot. The key was always there. What changed is that someone is now looking.

That small picture is a fair description of the past few days online.

What happened this week

We should be careful, because this is moving fast. Here is what the public record said as of October 21, 2026.

On October 17, a community member told Mozilla that the private keys behind eight certificates issued by an Indian certificate authority, eMudhra, could be worked out from public information. A certificate authority is one of the organisations your browser trusts to vouch that a website is who it claims to be. One researcher reported recovering a key in under a second on a laptop. One of the keys was, in effect, the number 4.

On October 21, the PHP project released emergency fixes for two critical flaws. PHP runs a large share of the world's websites. The flaws involve what happens when a request uses up the server's memory. Security firms Calif and Wiz reported them, and both say AI models helped find them, including OpenAI's GPT-5.6 Sol. Those credits are the companies' own. Governments told operators to update or take sites offline. Estimates of how many sites are exposed range from about one million to more than twenty million, and one analysis suggests roughly half of internet-facing PHP is too old to receive the fix at all. One report says the underlying weakness was first flagged in a 2024 audit and then sat for about two years. Attackers were already discussing it in criminal forums.

Neither story is only about technology. In both, an ordinary human shortcut or oversight sat quietly for a long time. The difference now is the speed at which someone, or something, notices.

The dark is closing

For decades, a great deal of error survived by being dull. A weak key, an unpatched server or an old library was hard to find unless somebody had the time and skill to go looking. Most people did not, so most mistakes lived out their lives unseen.

AI changes the economics of looking. A model can read an entire codebase for the price of a lunch. Researchers who track attacks report that the time between a flaw becoming public and being used against someone has been shrinking, while the time organisations take to fix critical problems has stayed roughly where it was. The figures differ by source, so we will not print one number. The direction is not in dispute.

There is a second point that is easy to miss. The same ability that helps a defender find the bug helps an attacker turn the fix into a weapon. A good tool is not on anybody's side. This is the difference between capability and competence that we described in "The Price of Understanding": the capacity to find a flaw is cheap and getting cheaper. The judgement about whom to tell first, how, and when is not cheap, and no model supplies it for us.

Someone was supposed to be watching

Behind every old, unpatched system there is a person who once built it and moved on. Many of the sites that will stay exposed are not the work of careless people. They are the quiet edges of someone's work that nobody remembered to tend. This is the other side of the idea in "Leave the Edges of the Field": a field's edges need keeping as well as leaving.

It is also a question of accountability, the subject of "Who Answers When an Agent Acts?". When a model finds the flaw we missed, the finding is not a failure of the model's character or ours. It simply asks the old question again: whose job was it to look after this? An honest organisation, or an honest family, can answer with a name. If nobody can, that is the first thing to repair.

That is stewardship in its plainest form. It is unglamorous, it rarely gets thanked, and it holds the rest up.

Calm is a discipline, not a mood

None of this requires dread. A world of constant alerts can make people feel they must be perfectly safe or perfectly afraid. The Christian answer is neither. We are not asked to be flawless, and we are not asked to be anxious. We are asked to be faithful in small things, to own up quickly, and to rest.

Jesus speaks to exactly this kind of fear: "Are not five sparrows sold for two farthings, and not one of them is forgotten before God? But even the very hairs of your head are all numbered. Fear not therefore: ye are of more value than many sparrows" (Luke 12:6-7, KJV). We are already fully known and not forgotten, so being found out is a smaller thing than it feels.

Rest is the part we forget. Constant vigilance is not the same as watchfulness, and the Sabbath still stands: one day in seven where we put the phone down and trust that the world does not depend on our attention. Careful people stay careful longer when they rest.

Where this leaves us

The farmhouse key did get moved, in the end, and the family did not make a fuss about it. They also did not stop sleeping at night. Someone simply wrote down a list: who has keys, where they are, who checks. It took an afternoon.

We will see more of this, not less. More flaws will be found, by people and by machines, and some of them will be ours. The faithful response is not to hide better, but to be the kind of people who are glad to be found early, and to remember that we were seen and kept before the first search began.

---

The Human Equation looks at artificial intelligence, technological progress, economics and human meaning, and tries to separate what we can observe, what we can reasonably expect and what remains ours to decide.

This letter is general information and is not security advice.

Sources and further reading

• The Register, "Indian certification authority eMudhra's private keys compromised" (20 October 2026); Google Security Blog on the compromised eMudhra intermediate certificates; Mozilla, Google and Apple notices. Details differ between sources.
• Cybersecurity Dive and CyberScoop on the PHP emergency fixes, CVE-2026-109618 and CVE-2026-109619 (21 October 2026); Wiz research blog on the same flaws. Model credits are the companies' own statements.
• VulnCheck, first-half 2026 exploitation report, as summarised by CSO Online; ProjectDiscovery, "The Vulnerability Curve Bent With the AI Curve." Methods differ, so figures are not directly comparable.
• Luke 12:6-7, King James Version.

Facts about these incidents are described as of October 21, 2026 and may have changed. Please check the originals.

The Arrenite team