Uneasy Money host: internet security was built for lazy attackers, not bots

One of the hosts of Unchained's Uneasy Money argued on the 22 October 2026 episode that the week's internet-security failures exposed schemes built on the assumption that attackers are human, and humans get bored. Automated attackers do not. For crypto, which runs on the same certificates, servers and web stacks as everything else, the point applies directly: wallets, front-ends and exchanges sit on this infrastructure.

The argument

One of the hosts put it plainly: "there are so many very tenuous, stupid schemes that we've invented that were predicated solely on people are lazy." (from 23:31). The difference now, the host argued, is persistence more than intelligence: "And we now have these aliens that are not lazy and they'll just run all day trying every thing and all of these things are falling apart." (from 23:31)

The example that opened the episode was eMudhra, a certificate authority whose keys turned out to be trivially guessable. As one host described it: "the private key has been the number four for over a year. It's been signing stuff since April twenty twenty five." (from 8:02). Another host was scathing about how the internet handles a compromised certificate authority once one is found, calling it "the most ghetto atrocious process that you've ever heard about." (from 17:54)

What it rests on

The eMudhra failure is documented in Mozilla's incident bug. On 17 October 2026 a researcher reported that the private keys of eight eMudhra intermediate certificates had been compromised, and supplied proof. Mozilla's investigation found the keys came from a key-generation ceremony on 30 April 2025 and that all eight were integers less than 256, "effectively all-zeroes apart from the last byte", recoverable almost instantly. The bug does not single out a key equal to 4; that detail is the hosts' and the episode description's.

The response was fast but improvised in the way one host described. The researcher's own timeline in the bug shows the first report went out by email to Apple, Chrome, Microsoft, Mozilla and eMudhra. Mozilla blocked the certificates in Firefox through OneCRL by 22:59 UTC the same day, eMudhra revoked them at 09:38 UTC on 18 October, and Sectigo, which had cross-signed some of them, finished its revocations on 19 October. Mozilla opened the public bug, in the researcher's words, "to avoid email cross-talk".

The PHP flaws the hosts discussed alongside it, known as PHP2Shell, were patched in emergency PHP releases on 21 October 2026 as CVE-2026-109618 and CVE-2026-109619, rated 9.2 on CVSS v4.0. A technical write-up estimates they expose about 70% of the web, because they sit in the PHP runtime itself rather than in any framework. The bugs were found by the security firm Calif together with OpenAI and Wiz, after OpenAI invited Calif into its Patch the Planet programme. Calif's write-up traces the bug pattern to 2004 and says it was found with generally available models, guided by a researcher's knowledge of PHP's history.

Where it was discussed

• Unchained: Uneasy Money: Is the Internet Breaking Because Bots Never Get Lazy?, 22 October 2026, from 8:02