AI-enabled hacking: cybersecurity experts warn of 'vulnerability tsunami' after PHP flaws dubbed 'Black October'
Cybersecurity leaders warned that AI-enabled hacking will expose deeper weaknesses in global internet infrastructure after researchers used AI to help uncover critical PHP vulnerabilities in October, a period dubbed 'Black October'.
AI-enabled hacking: cybersecurity experts warn of 'vulnerability tsunami' after PHP flaws dubbed 'Black October'
A string of warnings from the heads of major technology and security companies followed the announcement of critical flaws in PHP on 21 October, with several predicting that AI tools will expose more fundamental weaknesses in global internet infrastructure in the months ahead.
Why researchers call it 'Black October'
The period has been dubbed 'Black October' because researchers used AI to help identify critical flaws in a coding language used across millions of websites, flaws that may have gone unpatched for years.
- Massive bugs were found in PHP, a programming language that powers millions of websites and may have left them vulnerable to hackers for years.
- Some experts estimated that 70% of all sites on the internet were at risk of hacking.
Experts had warned for months about a 'vulnpocalypse', but the flaw announced on 21 October was the first as fundamental and critical found with AI's help.
Warnings from Altman, Anthropic and Salesforce
Sam Altman said on a Thursday evening that he no longer believes all bugs can be patched. "I no longer think we're going to be able to patch all bugs," said Sam Altman. Jason Clinton, Anthropic's deputy chief information security officer, predicted a 'vulnerability tsunami' in the next few months, writing in a post on X on Thursday evening that "There won't be enough time to patch critical infrastructure".
Marc Benioff, the Salesforce CEO, agreed and called it a 'code red'. Cloudflare CEO Matthew Prince said AI is uniquely able to find and identify security flaws in a way and at a pace that will feel catastrophic, and wrote that the next two years will be incredibly fraught with new tools with infinite patience to hunt for vulnerabilities across the internet.
Exploitation already under way
Attempts to exploit the PHP vulnerability have already begun. According to Prince, Cloudflare saw thousands of people trying to exploit the PHP flaws in the 10 hours before the announcement.
- Tens of thousands of attempts in the 45 minutes after the announcement
- Hundreds of thousands within two hours
- Millions now
Prince described the escalation in Cloudflare php attacks: "That jumped to tens of thousands in the 45 minutes post announcement, hundreds of thousands within 2 hours, and millions now".
How severe is the PHP vulnerability?
Researchers at AI security platform Wiz assessed the flaws in a blogpost.
among the most severe vulnerabilities discovered in PHP, and arguably in software history
The underlying flaws had been present for decades, and demonstrating their exploitability required an exceptionally complex chain of steps at the edge of what human researchers could achieve, according to Wiz researchers.
Response from governments and the NSA
Government and private websites across the US and UK temporarily took down their sites to patch the bugs after the vulnerabilities were announced. The US National Security Agency issued an alert recommending any site that runs on PHP implement the patches immediately, warning that malicious cyberactors may seek to exploit the bugs to access servers without authorization.
According to the NSA's warning, an attacker who gained such access could go on to steal sensitive data, disrupt services or move deeper into a network. The agency has urged every site running PHP to apply the patches at once.
