Black October Cybersecurity Experts Warn of AI Hacking
A PHP vulnerability announced on 21 October has prompted cybersecurity leaders to warn that AI could help attackers find and exploit software flaws faster than…
Black October cybersecurity experts are warning that AI could help attackers exploit critical software flaws faster than operators can fix them, after researchers disclosed a severe vulnerability in PHP on 21 October. Attempts to exploit the bugs climbed sharply after the announcement, according to Cloudflare CEO Matthew Prince.
The risk reaches beyond one programming language: PHP runs millions of websites, and experts said the flaws may have left sites exposed for years. Government and private websites in the US and UK temporarily took their sites offline to install patches.
The warning is immediate. The US National Security Agency recommended that every site running PHP apply the patches, saying attackers may seek unauthorized access to servers. The agency said such access could help them steal sensitive data, disrupt services or move deeper into a network.
Exploitation attempts rose after disclosure
Prince said Cloudflare, a security provider, saw thousands of attempts to exploit the PHP flaws in the 10 hours before the announcement. In a post on X, he said the figure rose to tens of thousands in the 45 minutes after disclosure, hundreds of thousands within two hours and millions by the time of his post.
The jump points to a practical problem for website operators: disclosure can quickly give malicious actors a reason to test systems that have not yet been patched. The Guardian reported that experts estimated 70% of websites on the internet could be at risk of hacking. That estimate concerns potential exposure, not confirmed breaches.
Researchers used AI to help identify the critical flaws. The underlying bugs had been present for decades, according to researchers at AI security platform Wiz, but proving they could be exploited required a complex chain of steps that would have stretched what human researchers could practically achieve.
That changes the pace of the security response. AI can help defenders find weaknesses, but cybersecurity leaders are also concerned that attackers will use similar tools to locate and exploit them at scale. Website operators now face pressure to assess whether their systems run PHP and apply the fixes without delay.
Executives warn of a wider vulnerability wave
Sam Altman said on Thursday evening, “I no longer think we’re going to be able to patch all bugs.” Jason Clinton, Anthropic’s deputy chief information security officer, predicted a “vulnerability tsunami” in the coming months and warned there would not be enough time to patch critical infrastructure.
Marc Benioff, Salesforce’s CEO, described the situation as a “code red.” Prince said AI could identify security flaws at a pace that leaves the security community unable to respond quickly enough. He wrote that the next two years would be “incredibly, incredibly, incredibly fraught” as new tools search the internet for vulnerabilities.
Wiz researchers called the PHP issues “among the most severe vulnerabilities discovered in PHP, and arguably in software history”. They said the flaws had been present for decades, while the technical difficulty of demonstrating exploitability had limited what human researchers could practically accomplish.
For organizations running affected sites, the immediate consequence is operational: patching may require temporary downtime, but leaving systems exposed could give attackers a path to sensitive data or wider network access. The NSA’s recommendation is direct: PHP site operators should implement the patches immediately.
Source: theguardian.com
