AI-driven attacks erupt intensively, and the cybersecurity world ushers in "Black October"

Article body

Late one ordinary Friday night, startup founder Colin Parsons was still asleep, while a group of hackers using AI to carry out cyberattacks had already begun reaching for his accounts...

The next morning, Parsons was jolted awake by a full 50 payment-deduction emails in his inbox—his account was being fraudulently charged, one transaction after another, to purchase compute services from Anthropic and OpenAI. When he tried to log in to the Discord customer service channel of the AI coding platform OpenCode to ask for help, what he saw left him even more helpless: every two seconds a meaningless piece of spam such as "Yo" or "uninstall Telegram" popped up in the channel, and his help post was instantly buried by the flood of messages.

Subsequent investigation showed that Parsons' unauthorized purchases were made using credentials he had stored on an AI coding website called OpenCode. OpenCode co-founder Dax Raas said on X that since October 16, OpenCode had been caught in an "uninterrupted" AI-driven cyberattack. "Damn it, we basically need people on duty around the clock, 24 hours a day, because that's what the hackers are doing," Raas said.

And clearly, Parsons' experience is far from an isolated case. In recent weeks, as hackers have massively deployed AI agents and automated attack tools, an unprecedented cyber storm has been sweeping the global internet. Many in the industry have already described this month as a "Black October" for the cybersecurity world.

Alarm bells ring for 70% of websites worldwide; multiple governments forced to "pull the plug"

On Wednesday, PHP, a foundational internet programming language, was revealed to have a major security vulnerability—as infrastructure supporting half the internet, once exploited by hackers, the flaw could put as many as 70% of websites worldwide at risk of being hacked. Tech giants including Amazon and Cloudflare both detected aggressive attempts by hackers to exploit the vulnerability.

Facing an imminent threat, the U.S. National Security Agency and the Federal Bureau of Investigation issued a rare and extreme warning to companies: if you cannot patch immediately, just "pull the plug"—shut down your websites.

For a time, the global internet was on edge. Some government websites in Canada, Belgium, France and the Netherlands, to prevent being breached before patching was complete, simply chose to proactively go offline to "cut themselves off for self-protection"; the well-known image forum 4chan also urgently disabled its comment function before a patch was released.

Patrick Garrity, a researcher at intelligence firm VulnCheck, noted that the PHP emergency-repair chaos was only the tip of the iceberg in this frantic week—this week alone, Node.js and streaming software Plex successively disclosed vulnerabilities, the AI gateway LiteLLM and the development platform Railway also suffered data breaches, and Indian certificate authority eMudhra was reported to have extremely weak keys.

According to a report VulnCheck is about to release, with AI adding fuel to the fire, the number of digital security flaws discovered has doubled year on year.

Matthew Prince, CEO of internet infrastructure giant Cloudflare, went further, warning that he had learned that large numbers of severe vulnerabilities were also lurking in several other critical software programs. "I think for the next few years, every week will feel like the sky is falling; for any system exposed to the internet, this kind of fire-alarm emergency response will become the norm."

Attack-and-defense timeline completely upended: from "months" to "hours"

Why has this wave of cyber crisis hit so ferociously?

Industry insiders say that in the past, finding bugs in massive codebases required extremely high technical barriers, and writing attack code to exploit vulnerabilities often required experienced professional hackers to spend weeks or even months. This left cyber defenders a precious "breathing window" to patch and roll out updates at a measured pace.

Shane Fry, chief technology officer of security firm RunSafe Security, pointed out that AI models can review codebases around the clock without interruption, uncover vulnerabilities one after another, and "weaponize" them into attack code in just a few hours.

Adam Meyers, senior vice president at cybersecurity giant CrowdStrike, also admitted: "We are seeing explosive growth in these 'agentic adversaries.' Not only highly skilled hackers are using them; even very low-skilled attackers are using them."

The speed of this AI evolution is staggering. Sherri Davidoff, founder of security consulting firm LMG Security, said that in a peer survey a year ago, almost no one had seen AI used in real cyberattacks; in the past quarter, it has become commonplace.

Steven Adair, president of cybersecurity firm Volexity, even predicted that in the coming weeks and even months, the world may see a dense wave of corporate "breach disclosures."

Is it "the good guys gaining an edge" or "the bad guys gaining the upper hand"?

Daniel Stenberg, chief developer of the file transfer tool curl, believes that vulnerabilities uncovered by AI models tend to be obscure and rare, making them hard for hackers to actually exploit.

Esteban Borges, head of research at intelligence firm Hunt.io, also noted that although hackers launched fierce probing against this week's PHP vulnerability, as of Thursday afternoon, the criminals he tracks did not appear to have pieced together a truly workable attack tool.

In the view of Cloudflare's Prince, although this AI-triggered wave of vulnerability discovery has caused the entire industry short-term pain, in the long run it is a good thing.

He vividly compared it to "slaying demons in a haunted house"—facing monsters head-on is certainly terrifying, but letting monsters lurk silently behind closed doors would be far worse.

"The reality is that we may be able to use this opportunity to thoroughly clean up the security risks that have accumulated at the foundations of the internet for years," Prince said.

(Source: Cailian Press) Mid-body embedded advertisement