"Black October" Sweeps the Global Internet! Is AI Completely Overturning the Cybersecurity Table?

At a late night on an ordinary Friday, startup founder Colin Parsons was still asleep, while a group of hackers using AI for cyberattacks had already begun reaching for his accounts... Early the next morning, Parsons was jolted awake by a full 50 payment notification emails in his inboxhis account was being fraudulently charged one transaction after another, used to purchase computing power services from Anthropic and OpenAI. When he tried to log into the Discord customer service channel of the AI coding platform OpenCode to seek help, the scene before him left him even more helpless: every two seconds, meaningless spam messages such as "Yo" or "uninstall Telegram" would pop up in the channel, and his help request post was instantly drowned out by the flood of messages. Subsequent investigation showed that Parsons' unauthorized purchases were completed using credentials he had stored on an AI coding website called OpenCode. OpenCode co-founder Dax Raas said on X that since October 16, OpenCode had been caught in an "uninterrupted" AI-driven cyberattack. "Damn it, we basically need to have people on duty 24 hours a day, because that's what the hackers are doing," Raas said. And clearly, Parsons' experience is by no means an isolated case. In recent weeks, as hackers have massively deployed AI agents and automated attack tools, an unprecedented cyber storm is sweeping across the global internet. Many industry insiders have already described this month as "Black October" in the cybersecurity world. Alarms raised for 70% of websites worldwide; multiple governments forced to "pull the plug" This AI-triggered cyber offense-defense battle reached a new climax this week. On Wednesday, PHP, a foundational internet programming language, was exposed as having a major security vulnerabilityas infrastructure supporting half of the internet, once this vulnerability is exploited by hackers, as many as 70% of websites worldwide could face the risk of being hacked. Tech giants including Amazon and Cloudflare both detected aggressive attempts by hackers to exploit the vulnerability. Facing an imminent threat, the U.S. National Security Agency and the Federal Bureau of Investigation issued a rare and extreme warning to enterprises: if patches cannot be applied immediately, simply "pull the plug"shut down the websites. For a time, the global internet was on edge. Some government websites in Canada, Belgium, France, and the Netherlands simply chose to proactively go offline to "disconnect and protect themselves" to prevent being breached by hackers before patching was completed; the well-known image forum 4chan also urgently disabled its comment function before the patch was released. Patrick Garrity, a researcher at intelligence firm VulnCheck, noted that the PHP emergency repair chaos was only the tip of the iceberg in this frantic weekin this week alone, Node.js and streaming software Plex successively disclosed vulnerabilities, AI gateway LiteLLM and development platform Railway also suffered data breaches, and Indian certificate authority eMudhra was reported to have extremely weak keys. According to a report soon to be released by VulnCheck, with AI adding fuel to the fire, the number of digital security flaws discovered has doubled year over year. Matthew Prince, CEO of internet infrastructure giant Cloudflare, further warned that he had learned that large numbers of severe vulnerabilities were also lurking in several other critical software products. "I think for the next several years, every week will feel like the sky is falling. For any system exposed to the internet, this kind of fire-alarm emergency response will become the norm." The offense-defense timeline completely overturned: from "months" to "hours" Why has this wave of cyber crisis come with such ferocity? The answer may lie in AI's complete reshaping of the cyber offense-defense "timeline." Industry insiders say that in the past, finding bugs in massive codebases required extremely high technical thresholds, and writing attack code to exploit vulnerabilities often required experienced professional hackers to spend weeks or even months. This left cyber defenders with a valuable "breathing window" to calmly apply patches and roll out updates. But now, AI has completely flipped the table. Shane Fry, chief technology officer of security company RunSafe Security, pointed out that AI models can conduct round-the-clock, uninterrupted reviews of codebases, uncover vulnerabilities one after another, and "weaponize" them into attack code within just a few hours. Adam Meyers, senior vice president at cybersecurity giant CrowdStrike, also admitted: "We are seeing this kind of 'agentic adversary' growing explosively. Not only are highly skilled hackers using it, but even very low-skilled attackers are using it." This pace of AI evolution is staggering. Sherri Davidoff, founder of security consulting firm LMG Security, said that in a peer survey a year ago, almost no one had seen AI used in real cyberattacks; but over the past quarter, it has become commonplace. Steven Adair, president of cybersecurity company Volexity, further predicted that in the coming weeks and even months, the world may see a dense wave of corporate "breach disclosure" announcements. Is it "the law gains one foot while the devil gains ten," or the other way around? Of course, although all experts agree that the response time for internet defenders has been compressed to the limit, the industry still has some differences over whether AI will evolve into an uncontrollable "hacker carnival." Daniel Stenberg, chief developer of the file transfer tool curl, believes that vulnerabilities unearthed by AI models tend to be obscure and rare, making it difficult for hackers to actually exploit them. Esteban Borges, head of research at intelligence firm Hunt.io, also noted that although hackers launched fierce probing against this week's PHP vulnerability, as of Thursday afternoon, the criminals he tracked did not appear to have yet pieced together a truly workable attack tool. In the view of Cloudflare's Prince, although this AI-triggered wave of vulnerability discovery has caused the entire industry severe short-term pain, in the long run it is a good thing. He vividly compared it to "slaying demons in a haunted house"facing monsters head-on is certainly terrifying, but letting monsters lurk silently behind closed doors would be far worse. "The reality is that we may be able to use this opportunity to thoroughly clean up the security risks that have accumulated in the internet's underlying layers for years," Prince said. This article is reprinted from "Cailian Press," edited by GMTEight's Feng Qiuyi.