‘Black October’: cybersecurity experts sound the alarm over new era of AI-enabled hacking

Cybersecurity leaders are warning people after a major security weakness was discovered this week. They believe artificial intelligence (AI) tools will find more serious problems in the systems that keep the internet working around the world in the coming months.

“I no longer think we’re going to be able to patch all bugs,” Sam Altman said on Thursday evening. He joined other technology leaders who are worried about the situation. Researchers are calling this period “Black October”. They used AI to help find serious security problems in a programming language used by millions of websites. Some of these problems may have existed for years without being fixed. Technology leaders warn that AI can now find security weaknesses much faster and in much larger numbers than before. Hackers may also use AI to take advantage of these weaknesses at a speed and scale never seen before.

Jason Clinton, Anthropic’s deputy chief information security officer, said the next few months will bring a “vulnerability tsunami”, meaning an enormous wave of security problems. “There won’t be enough time to patch critical infrastructure,” Clinton wrote on X on Thursday evening. He meant that organizations may not have enough time to fix important systems. Marc Benioff, the CEO of Salesforce, agreed and called the situation a “code red”, meaning a serious emergency.

Matthew Prince, the CEO of Cloudflare, said AI is especially good at finding security weaknesses. It can find them so quickly that cybersecurity experts may not be able to fix them fast enough. He warned that the situation could feel like a disaster. “It’s going to feel like the sky is falling. It’s going to feel like there’s nothing we can do.”

“The next two years are going to be incredibly, incredibly, incredibly fraught with new tools that have infinite patience to go look for vulnerabilities across the Internet,” he wrote on X. He meant that AI tools can keep searching for security problems without getting tired, creating serious challenges over the next two years.

Cybersecurity experts have been warning for months about a “vulnpocalypse”. This word describes a situation where AI makes it much easier to find large numbers of security bugs. But it was not until “Black October” that researchers used AI to discover a problem as basic and serious as the one announced on 21 October.

Researchers found major security bugs in a programming language called PHP. Millions of websites use PHP, and these bugs may have left those websites open to hackers for years. Some experts estimated that 70% of all websites on the internet were at risk of being hacked.

AI can help security experts find problems much faster than before. But technology leaders are also worried that people who want to cause harm will use AI to attack those same weaknesses just as quickly.

Hackers have already started trying to take advantage of the PHP security problem.

After the security problems were announced, government websites and privately owned websites across the US and UK temporarily went offline so their operators could fix the bugs. The US National Security Agency (NSA) issued a warning telling every website that uses PHP to install the fixes immediately. The NSA said people carrying out harmful cyberattacks might use these bugs to get into computer servers without permission.

“Such an access vector could help attackers steal sensitive data, disrupt services or move deeper into a network,” the NSA warning said. In simpler words, hackers could use this way into a system to steal private information, stop online services from working, or reach other parts of a computer network.

In a post on X, Prince said Cloudflare, a company that provides internet security services, had seen signs of thousands of people trying to use the PHP bugs to attack websites during the 10 hours before the problems were publicly announced.

“That jumped to tens of thousands in the 45 minutes post announcement, hundreds of thousands within 2 hours, and millions now,” he wrote. This means the number of attempts grew from thousands to tens of thousands in the first 45 minutes after the announcement, then to hundreds of thousands within two hours, and eventually to millions.

Researchers at Wiz, an AI security platform, wrote in a blog post that these were “among the most severe vulnerabilities discovered in PHP, and arguably in software history”. They believed the problems were among the worst ever found in PHP and possibly among the worst in the history of computer software.

“The underlying flaws had been present for decades, but demonstrating their exploitability required an exceptionally complex chain of steps, at the edge of what human researchers could practically achieve,” the researchers wrote. In simpler words, the problems had existed for decades, but proving that hackers could actually use them required many extremely difficult steps. The work was so complicated that it was close to the limit of what human researchers could realistically do.