Why the Cyberpocalypse Might Hit China Harder

Chang Che is a writer and contributor to the New Yorker . In August, researchers at a California security firm used an OpenAI model to find a software bug in PHP, a programming language that undergird some seventy per cent of the world’s websites, including Wikipedia and WordPress. They alerted PHP’s developers, who quietly began working on a fix. By late October, the fix was ready, but before they could alert the world, the break-in attempts had begun. Days earlier, Amazon detected someone trying to hack into its servers; attacks code began circulating online. Some governments and companies began pulling websites down, rather than risk a security breach. One security firm described the flaws as some of the worst ever found in PHP, “and arguably in software history.” Before AI, the internet might have looked, to a hacker, like a worn-out bug screen. You could discern some holes with a keen eye, and that knowledge was reliably asymmetric—others probably didn’t know about the holes you found. Moreover, tunneling through the holes undetected took months or years of human labor, talent, and money. Now, with AI, the internet looks more like a block of Swiss cheese: the holes are obvious, anyone can, or will, see them, and the time and cost it takes to exploit these software flaws have plunged alarmingly fast . According to Google’s incident response team , the average time it takes for cyber criminals to exploit a new vulnerability is -7 days, meaning hacking attempts are “routinely occurring before a patch is even released.” Hackers refer to unbeknownst software bugs like PHP as “zero-days” because a defender has had zero days to protect themselves upon its discovery. Once a hacker discovers a zero-day in, say, iOS software, every iPhone user is potentially vulnerable to a hack until Apple finds out about it, fixes it, releases a new patch, and, crucially, gets customers to install the software update. Beyond losing your crypto-wallets, there is the question of what the cyberpocalypse means, strategically, for the United States and China. According to the data tracking site Censys , the two countries reacted at drastically different speeds to the PHP zero-day. One week after its public disclosure, the United States had successfully patched over a quarter of the 14 million services exposed to the flaw. (Japan had about the same percentage.) China, by contrast, had patched an abysmal 4% of its potentially vulnerable services. ChinaTalk is a reader-supported publication. To receive new posts and support our work, consider becoming a free or paid subscriber. Why was China, who spent a decade building up a formidable cybersecurity governance system, so slow to patch one of the biggest software flaws in history? Until now, the cybersecurity industry was largely built around finding flaws. Companies buy them from hackers, and governments hoard them to spy on their enemies. An industry built around bug-discovery seems to resemble the AI race or the Manhattan Project: it’s a question of how a state can marshall a small elite group toward a specific goal. China is very good at the former—as it has repeatedly demonstrated with AI, semiconductors, batteries, robotics. We are now moving from an era of zero-day scarcity to zero-day abundance. Bugs that Washington, Moscow, and Beijing used to hoard like nuclear fission material are now becoming available to an educated AI user. An era of zero-day abundance will force cybersecurity to shift to an industry built around fixing flaws as fast as humanly, or superhumanly, possible. This is a challenge for the many, not the few—it demands something from your average IT person at a school, the contractor running a local water plant, a security team at a tech firm whose warnings may have previously been ignored. It’s almost a test of the metabolism of a society: how well bottom-up incentives are working. China, with its Leninist governance system, may have trouble in an era that demands such uncoordinated, yet collective, actions. Hayek and the birth of disclosure norms “Zero-days,” unlike proofs, can be weaponized, and in the 1990s, there were practically no rules for what one should do with the ingredients of a potential cyber-nuke. “White hat” hackers—people who hack to help shore up defenses—who told companies about their flaws were often ignored, bullied, or threatened with lawsuits. So hackers began posting the flaws publicly. This forced companies to fix them, but it also handed “black hat” hackers the cyber equivalent of a bank’s blueprint, so a deal had to be brokered. Entire books have been written about the battle between the hacker community and tech companies, but the upshot was that by the 2010s, an equilibrium solidified. Under the rules of “coordinated vulnerability disclosure,” a researcher notifies the affected company first, gives them time to fix it, then tells the world. Today, a web of institutions and standards, anchored in the United States, underwrite these norms. Google’s Project Zero, an elite bug-hunting team, gives software makers 90 days to fix a flaw before it goes public. The “bug bounty” program, which Netscape pioneered in 1995, went from a quirky experiment to an industry standard that can pay hackers six figures for a single flaw. Serious bugs get an ID number from CVE, a catalog run by the US government. What’s striking is that no one designed this system from the top-down. It more closely resembled Friedrich Hayek’s theory of “ spontaneous order ”: free, commercially motivated groups—hackers and companies—adjusted to each other and the rules and institutions emerged. Hackers wanted credit and rewards; firms needed time. Money supplied the incentives for a bug-patching ecology that resulted in a more secure web. One way to measure how American this metabolic process is is to compare the maturity of bug bounty programs in other countries. Out of the ten largest tech companies in the United States, nine of them have bug bounty programs, according to a 2026 study ; in China, the number is six out of ten. (The firms that have them, like Alibaba, are international facing, while the ones that don’t are state-owned like China Mobile.) The pay scale is incomparable. Apple and Google can pay millions of dollars for critical zero-day flaws, while top Chinese programs like Tencent top out at $15,000. The West underwrites the ecosystem for patching up the internet. After Snowden Of course, this state of affairs didn’t last. While the bug-disclosure norms were taking shape, there was also a parallel, secretive cyber-arms-trade going on. In This Is How They Tell Me the World Ends , published in 2021, the former New York Times cybersecurity reporter Nicole Perlroth shows how the NSA was secretly buying zero-days from hackers to spy on American citizens and the world. Hackers were paid life-changing sums to keep their flaws secret, and the exposure of this hoarding by the Snowden leaks helped break up the love affair between Chinese hackers and Western bug bounty programs. The Snowden revelations in 2013 catalyzed China’s cybersecurity arms race . In 2014, Xi Jinping took charge of a newly empowered cybersecurity division. Beijing began to pass laws to de-Americanize China’s tech stack, and state-sponsored cyberattacks on the United States skyrocketed. Among the biggest changes China implemented was to treat zero-days like national security assets. In 2018, Chinese hackers abruptly disappeared from the international hacking contests they once dominated. Contributions by Chinese researchers to Microsoft bug bounty programs plummeted in 2020. A year later, in 2021, Beijing passed a law that prohibited Chinese security researchers from publicizing zero-day flaws or passing them to a foreign bug-broker. They can report the bug to the company that runs the software or to China’s Ministry of Industry and Information Technology (MIIT). Any company in China that learns of a flaw has 48 hours to tell the ministry.