The Resilience Brief — Week 6: Awareness

Wednesday, the developers behind PHP — the programming language a huge share of the world's websites run on — released urgent fixes. Two critical vulnerabilities. They had been lurking in the code for more than a decade. Nobody found them the old way. AI did — researchers at Wiz, Calif and OpenAI, working with the PHP security team.

Then it moved fast. Cloudflare's CEO, Matthew Prince, late Wednesday: in the 10 hours before the flaws were even announced, they saw thousands of attempts to exploit them. Tens of thousands in the 45 minutes after the announcement. Hundreds of thousands in two hours. Millions now. Attempts, so far — no confirmed break-in has been reported. The fix is the patch. It shipped Tuesday.

Governments in Europe took websites offline as a precaution — in the Netherlands, the national ID and government portals went down. In Japan, Mitsubishi UFJ, Nomura and ANA suspended some services, the Finance Ministry paused part of its site, and Prime Minister Takaichi told website owners to check whether they run PHP and get ready to patch.

Read that again. The hole was there for years. The only thing that changed this week is that somebody finally saw it.

Wisdom: Wisdom starts with awareness — this week's pillar, and not by accident. Most of what's wrong in a life, a business, a codebase, isn't new. It's old and unlooked-at. The bill comes when it gets found by somebody else first.

Continuing the story this space has tracked for three weeks now. Sort the claim from the record, because this week they are two different things.

The claim: on Thursday, Iran's IRGC Navy said four tankers were hit and set afire during ship-to-ship oil transfers in the northern Persian Gulf, and three more struck mines west of the Strait of Hormuz — the most vessels reported hit in a single day since the war began Feb. 28. As of this morning that claim is still not verified. No vessels were named. UKMTO, which logs incidents reported by ships, has not corroborated the seven. President Trump said Iran is inventing hits to push oil up before the midterms. On Friday the IRGC claimed two more supertankers hit mines. Also unnamed. Also unconfirmed. The US military says there are no mines in the strait.

The record: UKMTO logged two projectile strikes in the same window. The Liberia-flagged Soyia, hit Tuesday southeast of Al Faw, crew safe. And the Kuwait-flagged Al Dasma, hit Wednesday west of Bukha — fire out, all 21 Indian crew safe, ship at anchor. Reuters reported Friday that October is now the worst month of the war for attacks on shipping. Transit numbers tell the closure plainly: IMF PortWatch recorded 4 transits on Oct. 18. The pre-crisis baseline is 85 a day.

And the next chapter is already being drawn up. The New York Times reported the US and Israeli militaries have developed specific plans for renewed strikes on Iran after the Nov. 3 midterms — energy infrastructure, nuclear facilities, missile and drone sites. No decision has been reported. Iran's seven conditions for reopening the strait are still the price.

Courage: Courage is still the crews. Claimed or confirmed, the strait is mined in the telling, watched, and priced like a war zone — and ships still move through it, because everything else stops if they don't. Everything else — the plans, the warnings, the conditions — is talk around what those crews actually do.

Tuesday, Reuters published its poll, Oct. 16–20: 94 of 100 economists expect the Fed to hold rates at 3.75%–4.00% at the Oct. 27–28 meeting next week. All 100 expect a hike in December.

That's a strange split and it's the whole story. Inflation is 3.7% — still hot. The Fed already hiked in September, unanimously, the first hike in three years. Chair Warsh has said almost nothing — he doesn't do guidance, and he isn't starting now. Even the critics in the poll basically said the Fed is treading water and getting behind. Maybe. Or it's the deliberate path — their words were a slower, more deliberate path — and December is the decision that matters.

Temperance: Temperance isn't doing nothing. It's refusing to let a hot number rush you into the wrong move at the wrong time. Wait when waiting is the plan. Move when it's time to move. The failure mode is flipping between the two every time a headline lands.

Wednesday in New Mexico, Judge Francis Mathew ordered Meta to pay $25 billion. One of the largest penalties in US history.

The road there: New Mexico sued in 2021, out of the Cambridge Analytica scandal — a political firm harvested data from as many as 87 million Facebook users through a third-party app. In September a jury found the company misled users about who had access to their data — 26 of 29 statements found misleading, 43,899,720 violations of the state's consumer protection law. At $5,000 a violation the math ran to $219.5 billion. The judge cut it to $25 billion, plus 15% annual interest until it's paid. The money is earmarked for New Mexico's public schools. Still $25 billion.

His line: Facebook's wrongdoing "goes to the heart of Facebook's core business practices."

Context that matters: other states settled. New Mexico didn't. It declined the multistate settlement and took the case to trial — the only state to do it. Meta says it's confident it will win on appeal. Thursday, Reuters reported legal experts think Meta has a strong chance of getting the number cut — the fight will be over whether a violation counts when nobody proved a specific person saw the statement and relied on it. Attorney General Torrez says the state is ready to defend it. Both things get argued in court. That's where it goes next.

Justice: Justice here isn't the number — and the number may not survive. It's that one state refused the easy settlement and made a jury hear it. Settlements are quiet. Verdicts make a record. Records are what hold.