Digital infrastructure may have an urban planning problem.
Within a few days of October, three kinds of shared dependency failed:
1/ Shared code: critical flaws in PHP, GitLab and Node.js, among others.
2/ Shared identities: ConnectWise's application identities, abused to reach Microsoft 365 tenants.
3/ Shared infrastructure: a power failure a few days ago in a Google Cloud zone in the UK only, yet which ultimately froze Revolut and its 80 million customers, worldwide.
Two clocks seem to be shortening. Amazon reported an exploitation attempt on the PHP flaws 4 days before the patches were released. And Microsoft, which assesses that the ConnectWise campaign was run by a China-aligned actor using ARTEX—an open-source agentic AI framework turned into a "hacking harness"—saw cases where less than 3 hours passed between choosing a target and obtaining privileged cloud access. Patching is what a fire brigade does once the fire has started. When exploitation begins before the fix exists, what remains is architecture: how far a failure can travel.
After the Great Fire of 1666, London was rebuilt dense again, but this time with wider main streets to slow the next fire. The fire also gave birth to a new trade: within a generation, insurers were marking the houses they covered and sending their own firemen. In 1834, fire struck London again: J. M. W. Turner famously painted the Parliament he watched burning—that very house where the rules are written—from the south bank of the Thames. Yet, thanks to the new firebreaks, London lost only a building, without losing a whole district.
Concentration makes failures correlated, and interconnection gives them paths to travel; firebreaks exist to cut those paths. Hyperconcentration is what accumulates when nobody prices correlated failure. And AI adds an irony: the PHP flaws were found with AI assistance, and the tools now probing our shared foundations rest on models made possible by the same concentration of capital, compute and data that built our digital empires. I am struck by how close together these shocks came: they recall the Great Invasions, which began to strike centralized empires that could no longer watch the full length of their frontiers.
Perhaps October is the start of a "security winter", a season in which exploitation can begin before the fix exists and discovery gets cheaper.
In 1667, right after the Great Fire, the English Parliament wrote London's new building rules. Can the digital city afford to wait for its own?
