From Cointelegraph · By Christina Comben
Cybersecurity professionals are having a brutal month.
What’s being dubbed Black October isn’t even over, and it’s already brought about several dozen major cyberattacks and AI-identified vulnerabilities across the internet.
When critical vulnerabilities in PHP, the programming language used by around 70% of websites, were uncovered with the help of AI tools and disclosed by the PHP Foundation on Oct. 21, the race to patch servers around the world began.
Cloud services provider Cloudflare reported millions of attempts to exploit the vulnerability after its disclosure, following thousands of attempts in the preceding hours.
Some countries, including France and Finland, temporarily pulled access to certain websites while the US National Security Agency (NSA) warned organizations to patch the flaws immediately or take affected systems offline.
“We are at Security Armageddon now,” said NEAR founder Illia Polosukhin. Anthropic’s chief security adviser Jason Clinton warned that, “as bad as things have gotten in the past 4 days, they are going to get a lot worse before they get better.”
Citizens of the United Kingdom are even being urged to “be ready” for an emergency, such as severe weather or cyberattacks, that could cut off access to critical infrastructure such as water, electricity or the internet. US military installation have been told to prep for 90 days of independent operation under the FORTRESS initiative.
Houston, do we have a problem?
Beyond rushing out to stockpile canned food and walkie-talkies, is there anything else ordinary people can do to mitigate their exposure?
So how bad is Black October, really?
“It’s really bad. It looks like the rest of the internet is waking up to the reality we had three months ago,” Rob Hamilton, a Bitcoin security researcher involved in the Bitcoin Red Team, tells Magazine.
UK government is urging citizens to be ready for an emergency. Source: gov.uk
In the past week or so, cloud platform Railway disclosed that an attacker has accessed and decrypted customer credentials and API keys, apparently targeting AI providers.
Related: France is world’s most dangerous place for Bitcoiners: 90 attacks in 7 months
Medical testing giant Quest Diagnostics confirmed a breach of private patient health data, while Indian security firm eMudhra was found to have eight digital certificate authorities with weak keys that could potentially have let attackers impersonate trusted websites. And code hosting platform GitHub experienced a major service disruption that highlighted how heavily the software world relies on shared infrastructure.
GitHub’s senior director of security, Austin Devers, says incidents like this are a “clear reminder that reliability requires constant work,” because modern development is “so connected.”