The world is currently facing a significant cybersecurity crisis referred to as “Black October,” highlighting just how exposed global online infrastructures are.
Recent major security breaches, hacks, and flaws have illustrated the ease with which sensitive online data can be compromised, whether it’s held by governments, companies, or individuals.
Scott Schober, the CEO of Berkeley Varitronics Systems in New Jersey, shared with The Post that “artificial intelligence is rapidly speeding up the identification of software vulnerabilities. Criminals can exploit these weaknesses before any government or corporate entity even has a chance to respond.”
“They really understand they have the upper hand. Governments just can’t keep pace.”
He also mentioned that you don’t have to be highly skilled to use AI for malicious purposes.
“AI can generate scripts on its own. You don’t even need to know programming,” he remarked. “It’s like earning a master’s degree without ever going to class.”
A critical incident involved significant flaws discovered in PHP, the programming language that underpins about 70% of the internet. These vulnerabilities could allow hackers to access servers and take control without needing a password.
Additional “Black October” events included harmful software spread through LiteLLM, which is commonly used by AI developers, prompting many businesses to urgently address programming flaws.
The potential real-world dangers are alarming. Cyber attackers could disrupt or contaminate water supplies, cut off electricity, or overwhelm sewage systems, especially in smaller towns that lack dedicated cybersecurity personnel.
Seven states have reported attempts at cyber sabotage on water treatment facilities: New Jersey, Oregon, Minnesota, Michigan, South Dakota, Alabama, and Georgia.
In July, more than 30 water systems in Minnesota were targeted, while an attack in Georgia resulted in a county issuing a boil-water advisory. It was reported that the Iran-linked group CyberAv3ngers was behind this spree, and they also attempted to breach Pennsylvania’s water infrastructure earlier this year.
A notable ransomware assault occurred in May 2021, when Colonial Pipeline had to shut down the oil supply to the East Coast after paying $4.4 million to Russian hackers.
“This is a major concern for everyone as it impacts economies, people’s lives, and public safety,” Schober emphasized.
He called for greater regulation and international cooperation, warning, “Without this, chaos will ensue. Problems will arise, and they will affect humanity.”
On a more positive note, non-criminals are also leveraging AI to find and address vulnerabilities before they can be exploited.
In a statement from Oct. 8, Anthropic reported that six months of AI scanning had identified over 29,000 potential issues, yet around only 6,000 were manually reviewed and resolved.
“Our human ability to validate these findings is quite limited,” the company remarked.
Experts are particularly worried about a potential “vulnpocalypse,” a term that captures the rapid increase in software weaknesses outpacing the capacity of defenders to manage and rectify them.
“It’s like a fast-paced game of cat and mouse,” Schober said.
On the darker side, organized crime is thriving, systematically stealing personal data and cross-referencing it with publicly available information, then selling this information on the dark web.
Targeted attacks have affected many of the largest companies in the U.S., where sensitive information has been stolen from organizations like UnitedHealth, Facebook, Microsoft, Ticketmaster, Yahoo, and National Public Data, which had 2.7 billion records compromised in 2024.
AI also aids in organizing stolen data, connecting fragmented details about potential victims and making fraud efforts more sophisticated, according to Schober.
Moreover, it seems that private conversations users have had with AI systems are also at risk of being compromised.
Schober advises users to be cautious and to refrain from sharing critical information, such as passwords, Social Security numbers, and bank details in chatbot interactions. It’s also wise to review documents before uploading them online to ensure no sensitive details are included.
To enhance security, he recommends using long and unique passwords across different sites, as well as enabling multifactor authentication.
European authorities have advised businesses that employ PHP software to collaborate with their hosting services, keep their systems updated, and consider isolating apps that are exposed when immediate fixes aren’t available.
While Schober acknowledged that AI can bolster defenses, he is concerned that criminals are advancing faster.
“It serves as a tool for both good and ill,” he concluded.
