Your Aunt's Light Bulbs

You know the look. You are three sentences into explaining why the subnet mask matters, and the eyes go flat. Not rude, not bored exactly, just gone. The face is still pointed at you out of politeness. Somewhere around the second octet you lost them, and you both know it, and neither of you says so.

I have been doing this a lot lately. Explaining, for the nth time, that you do not click the link in a text message about a parcel. Explaining that the bank will never ring and ask you to move your money somewhere safe. Doing the updates myself in the end, because it is faster, and because the alternative is watching someone try to find Settings while apologising for being slow.

I should admit the part I am not proud of. I get impatient. I hear it in my own voice before I can stop it, that flat clipped tone that says I have explained this already. Then I feel bad about it for the rest of the evening, because these are people I love, and the thing I was impatient about was them trying.

So this is not a piece about how patient we all ought to be. I am writing it partly to talk myself into it.

Here is why it matters more this month than last.

On 27 October, the Norwegian National Security Authority raised the national cyber risk level to high, and published the level openly for the first time (NSM, 2026). Their scale runs from very low to extremely high. Moderate is the normal state, the one where attacks on Norwegian organisations are simply expected. High is a step above the normal expectation of being attacked. The reasons they give are plain: successful operations against Norwegian organisations roughly tripled over six months, and AI tools now find weaknesses faster than the people patching them can keep up.

In the same fortnight, two flaws in PHP, together called php2shell, let an attacker run commands on a web server with no login at all. CISA put both on its catalogue of vulnerabilities being actively exploited (CISA, 2026a). PHP runs a very large share of the world’s websites, which means the flaw landed underneath an enormous amount of ordinary infrastructure that nobody thinks about, including a great many small Norwegian sites maintained by somebody’s nephew.

And four flaws in Plex Media Server, chained together, let an unauthenticated attacker take over the machine. CISA listed those as exploited too (CISA, 2026b). Plex is the film server in the living room. The thing your brother-in-law set up so the kids could watch cartoons.

That is the shape of it. The dangerous things this month were not exotic. They were a web server and a media box.

Their advice is addressed to organisations, and especially to those in critical societal functions. Fair enough. But look at what a house contains now. A router the ISP configured once in 2019. A media server. A doorbell with a camera. A robot vacuum with a floor plan of your home. Light bulbs that speak to a cloud service in a country you have never visited. None of it is critical infrastructure. All of it is a computer on the public internet, and most of it is running firmware that stopped receiving fixes some time ago.

If your aunt’s light bulbs get recruited into a botnet, your aunt will never know. The bulbs will work perfectly. They will turn on when she asks. And at three in the morning they will also be sending traffic at a public service that someone needs, and she will have become a participant in that without ever having made a decision about it.

This is the part that is worth sitting with. She did nothing wrong. She bought bulbs. The failure was not hers, and telling her it was is both cruel and useless.

Which brings me back to the glazed look.

The people who can do something about this are the people who already understand it, and there are not very many of us, and we are all tired. Nobody is coming to fix the firmware on a six year old doorbell. There is no national programme for your grandmother’s tablet. There is you, on a Sunday, with a cup of coffee going cold, asking what that little icon does.

I think that counts as infrastructure work, and I think it is undervalued precisely because it looks like being a good nephew.

So the practical version, the one I am going to try to hold myself to. Pick the three people most likely to be caught out. Ask what is actually plugged in at their house. Turn on automatic updates where they exist and write down what cannot be updated any more. Set up two step login on the mail account, because the mail account is the skeleton key to everything else. Tell them, once, in words that do not include the phrase threat actor, what a real message from the bank looks like.

And then do not sigh when they ask again.

The authority has a free self assessment at cybersjekk.no, and a list of basic principles for ICT security that is written for organisations but reads perfectly well for a household. Those are useful. They are not the hard part.

The hard part is the patience, and I am as bad at it as anyone.

Check in with your people this week.

References

CISA (2026a) Critical Vulnerabilities in PHP Require Immediate Patching. Available at: https://www.cisa.gov/news-events/alerts/2026/10/21/critical-vulnerabilities-php-require-immediate-patching (Accessed: 29 October 2026).

CISA (2026b) CISA Adds Six Known Exploited Vulnerabilities to Catalog. Available at: https://www.cisa.gov/news-events/alerts/2026/10/20/cisa-adds-six-known-exploited-vulnerabilities-catalog (Accessed: 29 October 2026).

NSM (2026) NSM hever det nasjonale cyberrisikonivået til HØYT. Available at: https://nsm.no/aktuelt/nsm-hever-det-nasjonale-cyberrisikonivaet-til-hoyt (Accessed: 29 October 2026).