“Black October”: Cybersecurity experts sound the alarm on the new era of AI-driven hacking | Technology

Cybersecurity leaders are sounding the alarm after the discovery of a major vulnerability this week. They predict that artificial intelligence tools will reveal more fundamental weaknesses in the global internet infrastructure in the coming months.

“I don’t think we’re going to be able to fix all the bugs anymore,” Sam Altman said Thursday evening, joining the chorus of leaders. Amid what’s being called “Black October,” in which researchers used AI to help identify critical flaws in a coding language used on millions of websites that may not have been patched in years, technology executives are warning about how AI will be used to both identify and exploit security vulnerabilities at an unprecedented scale and pace.

The next few months will see a “tsunami of vulnerability,” according to Jason Clinton, Anthropic’s deputy chief information security officer. “There won’t be enough time to update critical infrastructure,” Clinton said in an article on X Thursday evening. Marc Benioff, the CEO of Salesforce, agreed and called it a “code red.”

AI is uniquely capable of finding and identifying security vulnerabilities in a way and at a rate that will seem catastrophic because the security community won’t be able to act quickly enough to fix them, said Matthew Prince, CEO of Cloudflare. “We will feel like the sky is falling. We will feel like there is nothing we can do.

“The next two years are going to be incredibly, incredibly, incredibly loaded with new tools that have endless patience for scanning the Internet for vulnerabilities,” he wrote in an article on X.

While cybersecurity experts have been warning for months of a “vulnpocalypse,” or the ability of AI to more easily identify security bugs, it was not until “Black October” that researchers could use AI to find a flaw as fundamental and critical as the one announced on October 21.

Massive bugs have been discovered in a programming language called PHP, which may have left the millions of websites running on it vulnerable to hackers for years. Some experts estimate that 70% of all websites are at risk of being hacked.

However, just as AI will be used to help identify security vulnerabilities at an unprecedented rate, technology leaders fear that it will also be used by malicious actors to exploit these bugs at an unprecedented rate.

Attempts to exploit the PHP vulnerability have already begun.

After the vulnerabilities were announced, government and private websites in the United States and the United Kingdom temporarily shut down their sites to fix the bugs. The United States National Security Agency (NSA) has issued an alert recommending that any site running PHP implement the fixes immediately. Malicious cyber actors may seek to further exploit these bugs to gain unauthorized access to servers, the NSA said.

“Such an access vector could help attackers steal sensitive data, disrupt services, or penetrate deeper into a network,” the warning states.

In an article on

“It grew to tens of thousands within 45 minutes of the announcement, to hundreds of thousands within two hours, and to millions now,” he wrote.

In a blog post, researchers at AI security platform Wiz said it was “one of the most serious vulnerabilities discovered in PHP, and arguably in the history of the software.”

“The underlying flaws had been present for decades, but demonstrating their exploitability required an exceptionally complex chain of steps, at the limit of what human researchers could practically achieve,” they wrote.