The Year Everything Got Hackable

---

We’re not in a transition period anymore. We’re in the collapse.

The signs are everywhere if you’re paying attention—and they’re accelerating. In the past few weeks alone, we’ve watched Russian military hackers pwn thousands of consumer routers, researchers discovered a new attack that gives complete control of machines running Nvidia GPUs, and Google just moved up the “Q Day” deadline—when quantum computers will crack current encryption—from someday-future to 2029. That’s four years. Not a decade. Four.

I’ve been covering this space since the early 2010s, and I can tell you: this isn’t the normal drumbeat of security vulnerabilities we’re used to. This is different. This is the moment when the bill comes due for decades of building infrastructure on assumptions that no longer hold.

The Router Attack That Shouldn’t Shock You (But Does)

Let’s start with the router hack. Russian military operatives compromised thousands of consumer routers—the dumb boxes most of us don’t think about until they stop working. These aren’t boutique enterprise firewalls. These are the Netgears and Linksys devices your ISP shipped with your connection.

The reason this matters: routers are the invisible wall between your home network and the internet. They’re the thing that should be defending you. When they’re compromised by a state actor, every device on your network—your laptop, your security cameras, your kid’s iPad—becomes visible to adversaries. It’s not like someone stealing your car. It’s like someone copying your house key and now they can walk through your front door whenever they want.

What’s particularly galling is that consumer router security has been a joke for fifteen years. We’ve known this. Researchers have screamed about it. And yet here we are in 2025, and Russia’s military is just casually collecting access to thousands of them because, what, the patch cycle takes too long? The firmware update process is a nightmare? Users don’t apply updates?

All of it’s true.

But there’s a second-order problem nobody’s talking about enough: routers are often the jumping-off point for attacks on critical infrastructure. Once you’ve got network access, you’re looking at power grids, water systems, hospitals. The LAPD just had sensitive police documents stolen by the World Leaks gang—those kinds of breaches often start with compromised external-facing infrastructure that nobody even knew was vulnerable.

Photo by Efrem Efre / Pexels

The GPU Exploit That Proves We’re Stacking Debt

Then there’s the Rowhammer attack targeting Nvidia GPUs. If you don’t know what Rowhammer is, here’s the short version: it’s a hardware vulnerability that lets attackers flip individual bits in memory by rapidly accessing the same memory rows. It’s like pointing a water hose at a dam so hard that you can cause cracks in specific spots.

Rowhammer has been known since 2014. We’ve had a decade to patch this. And yet researchers just demonstrated it can give complete control of machines running Nvidia hardware.

Here’s why this matters for AI: basically every AI training cluster runs on Nvidia GPUs. Every major AI lab. Every startup building language models. If someone can give themselves complete control of those machines, they can steal training data, manipulate model weights, or just brick the whole operation.

My read: this is what happens when you grow the GPU market at hypersonic speed without spending equivalent effort on security. Nvidia’s been in hypergrowth mode for three years. You add defensive security architecture, you slow down. You don’t add it, you stay fast and you die slowly when adversaries figure out how to exploit you.

The problem is we might not have time to fix it before it matters.

The Quantum Sledgehammer Coming in 2029

This is the one that actually scares me.

Google moved up the Q Day deadline to 2029. That’s when quantum computers will have enough qubits and enough error correction to break the encryption that currently protects basically all digital secrets—banking, medical records, state secrets, everything.

But here’s the thing that should terrify you even more: quantum computers don’t need to be as expensive or as large as we thought. The headline says it plainly: they need “vastly fewer resources.” Which means more actors can build them. Not just Google, IBM, or the Chinese government. Smaller state actors. Well-funded criminal organizations. Maybe even individuals with enough money and obsession.

The timeline is insane. I remember when people talked about Q Day like it was 2040. Then 2035. Now it’s 2029. The goalposts don’t usually move toward you this fast unless the underlying science took a leap.

And we’re not ready. “Post-quantum cryptography” migration hasn’t even started at scale. Government and financial systems are still using 256-bit keys that’ll be worthless in four years. We’re trying to herd trillions of devices, billions of software systems, and millions of institutions toward new encryption standards while they’re all running at full speed.

This isn’t a problem we can solve with patches. This is a civilizational infrastructure problem, and we’re four years from the deadline.

Photo by UMA media / Pexels

What About the Other Stuff? (The Robot That Isn’t Ready, The Kids Australia’s Protecting)

Volkswagen’s testing self-driving microbuses in LA. This is fine. Genuinely fine. They’re being smart about it—they’re in testing, they know there’s a “long and winding regulatory road,” and they’re not pretending otherwise. Robotaxis will happen. They’ll probably be safer than human drivers eventually. But they’re not part of the security crisis. They’re just… normal progress.

Australia banning social media for children is interesting from a different angle. It’s the first country to actually do it. My opinion: this is the wedge. Other countries will follow. It won’t stop the problem—kids are clever and proxies exist—but it signals something real is shifting. We’re moving from “tech optimism” to “tech regulation” in a way that actually sticks. Whether you think that’s good or bad, it’s real.

Astropad’s Workbench—remote desktop for AI agents—is genuinely clever infrastructure. Letting people monitor and control AI agents from mobile devices with low latency opens new workflows. It’s not a crisis. It’s just product evolution.

The Real Picture

Here’s what ties these together: we’ve built a fragile, networked world that moves at the speed of software, but we’ve secured it like it was built in 1995. Routers run code from a decade ago. GPUs have hardware flaws nobody’s bothered to fix. Encryption assumes quantum computers won’t exist until 2045. Meanwhile, adversaries are patient, resourced, and moving fast.

The Russian router hack isn’t a crisis because of the routers. It’s a crisis because it proves that low-hanging fruit—the stuff we’ve known about for years—is still there for the picking. That tells me we’re going to be surprised by what else is hanging there.

I think 2025 is the year the security community stops pretending we have time to fix this methodically. We don’t. The next three to four years are going to be noisy, reactive, and sometimes panicked.

What I’m Watching

• Q Day drift in academic literature: If the 2029 deadline shifts to 2027 or 2028 in published papers by Q3 2025, that’s a signal the quantum timeline is moving faster than the public narrative. Watch cryptography research labs’ pre-prints, not press releases.

• Enterprise router replacement cycles: Companies will start forcing firmware updates or hardware swaps more aggressively. Watch for IT spending announcements from Fortune 500 companies in Q2-Q3. If spending surges on network infrastructure “refresh,” the Russian hack scared boardrooms.

• Rowhammer patches from GPU manufacturers: Nvidia and AMD will either patch Rowhammer in hardware or publicly explain why they can’t. If we see mitigation in software instead, that means the hardware fix is expensive or difficult. That’s a bad sign for AI infrastructure security.

• Post-quantum cryptography adoption announcements: Watch for the first major financial institution or government agency announcing PQC migration timelines before mid-2026. If nobody does it voluntarily, regulation will force it, and everyone will scramble at once. Chaos theater.