‘Black October’: cybersecurity experts sound the alarm over new era of AI-enabled hacking
Cybersecurity experts are warning of a new era of AI-enabled hacking after discovering critical vulnerabilities in PHP, a programming language used across millions of websites.
The discovery has triggered what experts are calling 'Black October,' with AI tools revealing critical flaws in PHP that may have left millions of websites vulnerable for years. The vulnerability has prompted warnings about a new era of AI-powered hacking that could overwhelm cybersecurity defenses.
Some experts estimate that 70% of all websites on the internet were potentially at risk from these PHP flaws. The vulnerabilities were particularly severe because they had remained undetected for decades, requiring complex chains of steps to demonstrate their exploitability.
Unprecedented Scale
Tech leaders are predicting a 'vulnerability tsunami' in the coming months as AI tools identify and exploit security vulnerabilities at an unprecedented scale and pace. Matthew Prince, Cloudflare's CEO, warned that the next two years will be 'incredibly fraught with new tools that have infinite patience to go look for vulnerabilities across the Internet.'
It's going to feel like the sky is falling. It's going to feel like there's nothing we can do.
Exploitation Already Underway
Attempts to exploit the PHP vulnerability began immediately after its discovery. Cloudflare reported seeing thousands of attempts in the hours before the vulnerability was publicly announced, with that number jumping to tens of thousands within 45 minutes of the announcement, hundreds of thousands within two hours, and millions since.
The US National Security Agency (NSA) issued an alert recommending any site running on PHP implement patches immediately. The warning noted that malicious actors could use these vulnerabilities to 'steal sensitive data, disrupt services or move deeper into a network.'
Such an access vector could help attackers steal sensitive data, disrupt services or move deeper into a network.
Patch Race
Government and private websites across the US and UK temporarily took down their systems to patch the bugs. However, experts question whether traditional patching methods will be sufficient to keep pace with AI-driven discoveries.
Sam Altman expressed doubt about the effectiveness of patching all bugs, while Jason Clinton, Anthropic's deputy chief information security officer, stated there 'won't be enough time to patch critical infrastructure.' Marc Benioff, Salesforce's CEO, called the situation 'code red.'
Researchers at Wiz described the PHP vulnerabilities as 'among the most severe discovered in PHP, and arguably in software history,' noting that AI made it possible to demonstrate their exploitability, which had been beyond practical human capability.
Related
