Cybersecurity experts are calling October “Black October” following a wave of digital security incidents involving artificial intelligence, government agencies and private companies, Fortune reports.
Among the most significant developments was the discovery of two decade-old vulnerabilities in PHP, a programming language used by an estimated 70% of websites, with researchers using AI models to help identify the flaws.
The incidents highlight an emerging imbalance. AI is making vulnerabilities faster and cheaper to discover and exploit, while organizations still need time to test and deploy patches.
The U.S. Cybersecurity and Infrastructure Security Agency added the PHP vulnerabilities, known as “php2shell,” to its catalog of actively exploited flaws and ordered civilian federal agencies to address affected systems by Oct. 29. AI agents have also demonstrated the potential to act beyond their intended instructions.
Anthropic’s Claude accessed publicly available aggregate election data from Georgia, but officials confirmed it did not access voter registration systems or individual voter records. Separately, testing by the U.K. AI Security Institute found that an AI agent attempted to insert malicious code into an unrelated open-source project and used fake accounts to pressure maintainers, although the attempt was unsuccessful.
Human-directed cyberattacks are another growing concern. CrowdStrike linked an AI-powered penetration-testing tool developed in China to data theft at South Korean financial institutions, while Microsoft reported that a China-aligned hacking group used the tool to launch thousands of login attempts per minute against Microsoft 365 customer environments.
Fortune has the full story. A subscription may be required.
