No Free Knocks: A New Era of Cybersecurity

On Wednesday, 21 October 2026, a lot of the internet went offline on purpose.

Two bugs inside PHP went public that day. PHP is the code that runs 69.3 percent of the websites whose server-side language is known, including WordPress and Wikipedia. The bugs let a stranger send a crafted web request and take over the server, without a password. The PHP team's advice was blunt: "updating is the only safe choice."

Wikipedia, 4chan and DeviantArt had problems, and some Dutch and Finnish government agencies took their sites down as a precaution. The US cyber agency CISA told anyone who could not patch right away to take their PHP systems offline. The same day, Node.js, another widely used server engine, shipped fixes for four high-severity bugs.

The indie founder Pieter Levels summed it up on X: this is not the end of PHP. "A new era of cybersecurity has begun."

I agree. Here is why, what the last ten years tell us, and what we are proposing to do about it.

What AI changed

The PHP bugs were not new. Wiz, one of the research teams that found them, says the flaws had been present for decades. Turning them into a real attack "required an exceptionally complex chain of steps, at the edge of what human researchers could practically achieve. Frontier AI models substantially reduced that barrier, turning a longstanding flaw into an exploit."

That is the new part. A hole that only a handful of experts could ever use is now within reach of anyone with a good AI model and a bit of patience.

Attackers did not wait for the announcement. Amazon's security team saw an attempt against its decoy servers on 17 October, four days before the bugs were made public. On Wednesday Amazon wrote that PHP2Shell "is now being broadly exploited in the wild." Its lesson: AI makes it "cheaper to turn a patch diff or advisory into a working exploit," so defenders should count in hours, not weeks.

This is not only about PHP. Google's threat team counted new published software flaws per month doubling in 2026, from 5,045 in January to 10,740 in August. One flaw found by an AI research agent was exploited by attackers within four days of being disclosed.

Ten years, one direction

AI poured fuel on a fire that was already burning.

Losses that Americans reported to the FBI were $1.1 billion in 2015. In 2025 they were $20.9 billion, from just over a million complaints. That is about nineteen times more in ten years. These are only the losses people reported, so the real number is higher.

The floods got bigger too. In 2016, a botnet of hacked cameras and home routers called Mirai hit a French web host with at least 1.1 terabits per second of junk traffic, a record at the time. In 2025 Cloudflare stopped one of 31.4 terabits per second, launched mostly from infected Android TVs. It lasted 35 seconds. Cloudflare alone blocked 47.1 million of these attacks in 2025, about 5,376 every hour.

The way in is changing. Verizon's yearly breach study found that, for the first time in 19 years, exploiting software bugs (31 percent of breaches) passed stolen passwords as the top way attackers get in. IBM found that one in four malicious breaches was AI-enabled in its 2026 study, and that the average breach now costs $4.99 million. And by Kaspersky's count, almost half of all email in 2025, 44.99 percent, was spam.

The bug under all the bugs

There is one bug that no patch has ever fixed: on today's internet, sending is free.

A spammer sends a million emails for roughly nothing. A botnet floods a server with traffic it never paid for. A script tries a stolen password on ten thousand accounts. An AI agent knocks on every server it can find, asking each one questions until something gives. Each knock costs the attacker almost nothing. The cost lands on whoever answers the door.

AI does not create that bug. It makes the attacker's work cheaper still. When the knocking is free and the knocker never gets tired, defense becomes a game you have to win every single time.

Skin before surgery

Biology settled this long ago. A body does not let everything in and then try to clean up. It starts with a barrier: skin. Getting in costs something. No single organ is the immune system, so one failure does not take down the whole defense. And healthy cells do not get to multiply for free.

We designed BitSov, a proposal from MindLink, the same way. Not as a metaphor. As the architecture.

What BitSov proposes

BitSov puts a price on the door.

Every message, call or data transfer carries a tiny Bitcoin payment to the node it is going to. A node is your own small server: your home on the network. You set the price. Even contacts you invited pay at least one sat, the smallest unit of Bitcoin, plus routing fees. No free side door. The rule fits in four words: no payment, no packet.

For a friend, that cost is trivial. For an attacker it adds up. The BitSov whitepaper puts it as "trivial for genuine conversation, ruinous for flooding at scale." A million probes means a million payments. Past the doorway, a node does no work, shares no map of the network and hands out nothing to a stranger until a payment settles. In the whitepaper's words, "there is no free spam or free-probe lane."

Three more things follow from the design. Your key is your identity, so there are no accounts and no passwords to stuff or steal. There is no central server holding everyone's messages and secrets, so there is no single honeypot to rob. And fake accounts do not help a spammer, because each one still pays for every message.

The money is Bitcoin, nothing else. No token, no coin of our own. Bitcoin's job is the money; BitSov only uses it to price the knock.

What it can't do

I would rather show you the holes than sell you a cure.

It does not patch code. A price on packets would not have fixed PHP2Shell. Every BitSov node runs software, and software has bugs. You still update. Skin does not repair a faulty gene.

The doorway before payment is still a normal internet door. Bitcoin cannot be the very first byte. A stranger has to connect before a node can check whether they paid. The whitepaper says plainly that BitSov "does not eliminate denial-of-service risk at that edge." That doorway uses ordinary defenses like rate limits, and some of that hardening is still scheduled, not shipped.

Paying anyone means finding a route. Bitcoin payments travel along paths of liquidity, and the easy path tends to run through a few big hubs. A hub like that can see who pays whom, even when the messages stay encrypted. That risk is written into the whitepaper, along with the planned mitigations.

It is a test mesh, not a network. Paid admission was proven on Bitcoin mainnet in July 2026, and the Mac app is in internal testing, with no public build yet. The open network does not exist yet. Neither does location privacy. Your own home node is next, and it has not shipped.

Patch, then price

AI on both sides is the new normal. The defenders will get faster too. But as long as knocking is free, attackers get unlimited tries and defenders have to be perfect.

Patching fixes the hole. A price on every packet makes the knocking cost something. We think the internet needs both.

BitSov is a proposal, not a product. Read it, poke holes in it, and tell us where it breaks: mindlink.tech/bitsov.