‘Black October’ exposes how criminals use AI to cause real-world chaos — but you can protect yourself

The world has been plunged into a cyber-security crisis, known as “Black October,” which exposed how vulnerable much of the world’s online infrastructure is.

Major security incidents, hacks and flaws across the globe have shown how easily online data stored by governments, companies and individuals can be hacked.

“Artificial intelligence is dramatically accelerating the discovery of software weaknesses [and] vulnerabilities and criminals can exploit them before a government or a company can even have enough time to respond,” Scott Schober, CEO of New Jersey-based Berkeley Varitronics Systems, told The Post.

“They know they’re ahead of the curve. Governments can’t keep up.”

He added that criminals don’t even have to be especially technical to use AI nefariously.

“AI can write the scripts for you. You don’t have to be a programmer anymore,” Schober added. “It’s like getting a master’s degree without attending a day of college.”

One of the most major incidents was when serious flaws in PHP — the programming code that serves as the backbone on which 70% of the world’s internet sites are built — were found, which could have allowed hackers to break into servers and take control without a password.

Other “Black October” incidents have included malicious software distributed through LiteLLM, a tool used by AI developers, and many other companies rushing to fix flaws in their programming.

The threats posed to the real world are serious. For example, cyber attackers can try to disrupt or poison water supplies, cut off electricity or overload sewage processing plants. This is particularly dangerous in smaller municipalities without dedicated cybersecurity teams.

Seven states have confirmed attempts to cyber sabotage water plants: New Jersey, Oregon, Minnesota, Michigan, South Dakota, Alabama and Georgia.

More than 30 Minnesota water systems were attacked in July, while a Georgia attack led to a boil-water advisory in one county, according to the Center for Strategic and International Studies (CSIS). Iran-linked group CyberAv3ngers claimed responsibility for the campaign. Iran-linked hackers also targeted Pennsylvania water infrastructure in 2023, CSIS noted.

Meanwhile, one of the most successful ransomware attacks against the US took place in in May 2021, and resulted in Colonial Pipeline shutting down its oil system, disrupting a major supply of fuel to the East Coast, which they paid $4.4 million to Russian hackers to resolve.

“It’s a concern for everybody because it affects economies, people and their livelihoods and public safety,” Schober added.

Calling for stronger oversight and international coordination, he added: “There will be havoc otherwise. There will be problems, and it will affect humanity.”

On the positive side, non-criminals are also using AI to identify problems and flaws and “plug” them before they are hacked.

In an Oct. 8 statement, Anthropic said six months of AI scanning had flagged more than 29,000 potential vulnerabilities. However, humans had manually reviewed and fixed only about 6,000.

“We remain bottlenecked on our human capacity to validate these findings,” the company said at the time.

The main concern is a “vulnpocalypse” a term used by experts to describe a backlog of weaknesses growing faster than defenders can assess and fix them.

“It shows that it’s like a cat and mouse game, but it’s at a much faster pace now,” Schober added.

Meanwhile, the underworld is organized: hacking and stealing information, personal details and other material, cross-referencing it with what’s available on the internet and then selling it on the dark web.

Most of the US’s biggest companies have been hacked and had sensitive data stolen from them, at some point. Among the most severe have been hacks of UnitedHealth, Facebook, Microsoft, Ticketmaster, Yahoo and National Public Data — one of the largest databasing companies which had 2.7 billion records stolen in 2024.

AI also helps sort stolen records and connects scattered details of potential victims into onto one place, making fraud and extortion more targeted, according to Schober.

People’s private chats with AI have also been stolen on a large scale.

Schober urges users to limit what they share, saying to keep passwords, Social Security numbers, bank details and sensitive family information out of chatbot conversations. Users should always check and documents they upload to the internet for private details too.

For account security, he recommends using long, unique passwords and different passwords for every site, as well as multifactor authentication.

European authorities have advised businesses using PHP software to coordinate with their hosting providers, install updates and consider isolating any exposed applications when immediate repairs are impossible.

Schober acknowledged that AI can strengthen defenses as well as attacks, but his concern is the criminals are one step ahead — and working faster.

“It’s a tool for good and for bad,” he said.