'Black October' security findings: AI agents make exploiting old flaws cost pennies

LexSokolin · x · 2026-10-24

LexSokolin recounts nearly falling for an elaborate phishing attempt, then walks through the latest "Black October" security findings showing AI makes existing weaknesses far cheaper to find and exploit — 10k agents working overnight for the cost of a latte or two.

Key incidents:

Amazon spotted an attempted attack on website software four days before the public warning; the flaws allowed passwordless takeover while businesses were already being targeted.
PHP (powering WordPress and much of the web) needed emergency fixes for two flaws enabling login-free server takeover; Vercel added firewall rules early, but site owners still must patch.
eMudhra, a certificate provider, had 8 keys that were trivially guessable — one was literally the number 4.
NorForge researchers found criminals running AI agents against online shops and payment systems; one group had 1,100+ attack projects on its dashboards.
Quest Diagnostics disclosed a breach with patient records potentially accessed.

Practical reminders: use a password manager, turn on 2FA, verify unexpected money/download requests via known channels — being in tech doesn't make you immune.

Original post →

'Black October' security findings: AI agents make exploiting old flaws cost pennies

More from Safety