PHP, Railway, Node, eMudhra, all just in the last few days. Agentic cyberwarfare is well underway. I've been expecting this week for awhile now, and I'm certain it's only going to get worse before it gets better.
Silly idea. Physical businesses don't leave their doors unlocked and their grilles rolled up overnight and unattended. If you aren't running a sophisticated automated defense, does it make sense to leave your valuables exposed to an automated offense? If you run a services company, domestic ecomm or anything with low traffic off-hours, what about keeping business hours? As in: shutting the applications down overnight.
Lately, I've been thinking about the cost ratio between a few overnight sales and a successful automated attack. Then the PHP CVE this week. Governments are shutting down websites in response. Then I started wondering about the scale and industry at which this would actually become infeasible, and there's an answer in the past. TV networks used to go off the air overnight too. We didn't take 24/7 availability for granted until computers did it for us. Now availability has become a bigger liability again. This doesn't solve any problems. Maybe it evens out some of the asymmetry, temporarily, in that at least someone is awake to mind the store, until the bots do that for us too.
Turning off servers overnight is an absolutely crazy idea I would have laughed at until pretty recently. It doesn't make sense for any scaled use case, where you should already be running coverage and automation. I'm thinking of small shops that can't afford any of that and people who simply have no idea what to do in the face of this onslaught. IT security people need their sleep!