Dear reader,
At 13:00 CEST on 21 October, the European Banking Authority took its website offline. CERT-EU had warned organisations about “two critical security flaws in software used to run many websites”, and the EBA chose to shut the site until it could apply the fixes. It came back at 14:00 the next day and moved four consultation deadlines (EBA). The same day CERT-EU and other EU bodies issued a joint statement on two critical flaws in PHP, the language behind a large share of the web, and told organisations to “prioritise internet-facing systems” (ENISA). According to ENISA, the fixed versions came out at 13:40 UTC, almost three hours after the EBA had gone offline.
Also on 21 October, Microsoft attributed the recent compromise of ConnectWise’s cloud backup service to a China-aligned group it calls Storm-0940, which used an AI hacking framework against the service’s downstream customers. In my view they are the same story: AI has made software flaws much cheaper to find and to exploit. Software makers, the companies that run their software and attackers all use the same models to do it.
PHP’s flaw was first spotted in 2024#
The PHP Foundation has published its account of the two flaws, both of which allow remote code execution (PHP Foundation). A PHP developer found the first signs of the underlying problem during an audit in 2024. Nobody found a way to exploit it at the time. This year Calif reported a working remote code execution on 11 August, Wiz on 24 August and OpenAI further attack routes on 18 September. All three used AI models. Wiz wrote that “a single researcher completed in a week what previously would have taken a world-class team months of work” (Wiz).
The fix took more than two months after Calif’s report. The Foundation explains the delay itself: “the delay was a structural failure, caused by both the security team’s decision process and its lack of resources.” PHP’s security work “still depends on a small group of foundation-funded developers”.
Amazon recorded an attempt to exploit the flaw in its decoy servers on 17 October, before any public disclosure, though it says it cannot tell whether the attempt would have worked (AWS).
Attackers use the same tools#
Microsoft’s report on Storm-0940 describes ARTEX as “an open-source penetration testing framework that can use any AI model”. In several cases “the time from initial targeting to privileged access was less than 3 hours”. It tried to sign in to more than 2,250 customer tenants, mostly without success, and Microsoft notes that a successful sign-in does not show that data was taken (Microsoft).
Anthropic’s September threat report describes a group, GTG-50029, that used Claude to build an exploit for a previously undocumented WordPress flaw; it “succeeded against at least four victim websites” (Anthropic).
Another group, GTG-50020, stole production AI API keys from an AI vendor’s evaluation sandbox and then “attacked roughly thirty AI companies in about four days”. Last week brought two more cases. No source connects them to PHP or to each other. Railway, a hosting platform, says an intruder may have read stored keys in up to about 100,000 customer workspaces between 20 and 22 October, and was “attempting to obtain AI provider API keys to perform distillation attacks”, that is, to use someone else’s paid access to train a copy of a model (Railway). At LiteLLM, an open-source gateway many companies use to reach several model providers, an attacker used a master key that had leaked in May and was never revoked to push a malicious release on 21 October (LiteLLM).
Software makers and their customers use them too#
Mozilla says Firefox 150, released in April, fixed 271 vulnerabilities found by an early version of Anthropic’s Claude Mythos Preview (Mozilla). As of 2 October, Anthropic had disclosed 6,157 vulnerabilities across 591 open-source projects; to its knowledge 516 have been patched (Anthropic). CERT Polska, using OpenAI’s cyber-security models, found six vulnerabilities in MikroTik’s RouterOS; MikroTik released fixes and CERT Polska confirmed they block the attacks (NASK, 23 October).
Banks are using the same models on the software they run. The three European supervisory authorities wrote in July that banks’ “red teaming capabilities can be enhanced with AI solutions” (ESAs). On 14 October, Bank of America’s chief executive Brian Moynihan told analysts that part of the quarter’s costs went on “remediation for the Mythos implementation”, and that the bank “added 1,000 extra staff to work on that, not in the headcount but in consultants” (transcript, p. 11). In a CNBC interview the same day he named Anthropic’s Mythos as one of the models that found the flaws the consultants are fixing (TechRadar, Bloomberg Law). He did not say how serious the flaws are.
Fixing is the slow part#
On 8 October Anthropic wrote about its own vulnerability programme: “partners uncovered many vulnerabilities, but we haven’t yet achieved a sufficient reduction in cyber risk.” Its explanation: “It’s easier than ever to find vulnerabilities, but verifying, prioritizing, and fixing these findings remains challenging”, and “we often saw months pass between a vulnerability being found and being fixed” (Anthropic).
The UK Financial Conduct Authority reached a similar view after talking to firms. Its September review is headed “Vulnerability discovery is accelerating faster than firms’ ability to respond” (FCA). Verizon’s 2026 breach report puts the median time from detection to full remediation at 43 days, up from 32 (Verizon DBIR 2026).
VulnCheck, which tracks exploited vulnerabilities, has not seen attacks speed up at the same rate. It found that “early exploitation activity in the first half of 2026 is holding steady rather than accelerating”. Of 1,061 vulnerabilities attributed to AI-assisted discovery in its two datasets, 14, or 1.3%, have been confirmed as exploited (VulnCheck). So far, the number of findings has grown faster than the number of attacks that use them.
Companies still have to install the fixes#
In my view, whether AI testing makes a company safer depends on how many people it has to fix what the testing finds. Each fix has to be installed across the company’s own systems and tested, and the services have to keep running while that happens. Bank of America hired 1,000 consultants for this work. A firm that buys AI testing without adding people for remediation ends up with a longer list of known flaws it has not fixed.
Briefing#
On 22 October, Barclays said it expects to reduce its workforce by about 5,000 full-time employees. Group Finance Director Anna Cross told analysts the cuts include “fewer developers as AI makes our people more productive” (Barclays Q3 call transcript). The 5,000 is a planned reduction across the bank’s restructuring, not a count of jobs already replaced by AI.
On 19 October, UODO’s president Mirosław Wróblewski met Pamela Krzypkowska, chair of KRiBSI, the commission that will supervise AI in Poland, to discuss how the two bodies will work together. UODO says KRiBSI is due to start work in November, and that compliance with the AI Act “nie zwalnia z obowiązku przestrzegania przepisów o ochronie danych osobowych” (UODO). A Polish firm that uses personal data in an AI system will deal with both, and the two have only begun to agree who handles what.
On 21 October, EU governments agreed their negotiating position on the data and privacy part of the Digital Omnibus. The Council keeps the current definition of personal data and replaces the proposed single EU incident-reporting point with national entry points (Council of the EU). Talks with the Parliament wait for its own position, so none of this changes current GDPR obligations.
Summary#
In the week of 17 to 23 October, a PHP flaw first spotted in 2024 was turned into working exploits with AI and patched only after the EBA had taken its website offline. Microsoft tied the ConnectWise breach to a group that uses an AI hacking framework, and attackers tried to obtain companies’ AI keys at Railway and LiteLLM. Software makers, banks and Poland’s CERT use the same models to find flaws.
OpenAI says defenders now get its strongest security models before attackers do (OpenAI). In my view that helps a company that tests its own systems with them only if it can also install fixes faster than it does today.
Stay balanced, Krzysztof
Krzysztof Goworek is founder of Quintant — AI advisory that gets enterprises from experiment to production value.