AI-accelerated cyberattacks: critical vulnerabilities surge in October 2026
In brief
- A 48-hour surge of critical vulnerabilities hit core software like PHP, GitLab and Node.js.
- Malicious groups, including state actors, exploited agentic tools to target thousands of victims within hours.
- Anthropic and independent auditors warn the threat will worsen and urge stronger defenses and funding.
A surge of critical vulnerabilities and major breaches hit the software ecosystem and cybersecurity in just 48 hours, according to AINews. Critical flaws were disclosed in PHP, GitLab, Node.js, NGINX and HTTP/3, while supply-chain incidents affected LiteLLM, Railway and Zeabur. A certificate authority, eMudhra, was forced to exit the business after weak keys were discovered. Healthcare data was also exposed at Quest Diagnostics, which serves half of US hospitals.
Malicious actors, including China-aligned groups, exploited agentic tools to target thousands of Microsoft 365 tenants within hours. CrowdStrike documented four operators running similar campaigns, including one that struck 15 Argentine healthcare organizations. Major US banks detected unauthorized agents inside customer accounts, while researchers and senators urged stronger safeguards. Anthropic warns the situation will worsen before improving and calls for increased funding for foundational cybersecurity.
New initiatives are emerging to counter the threat: large-scale formal verification, automated remediation tools and enhanced audits, such as those conducted by METR and Redwood Research at OpenAI. Specialized models like MiniMax M3.1 Flash or Carbon-X now integrate advanced security features, reflecting shifting priorities in the sector.
What it changes for you
- CybersecuritySecurity teams must prepare for a rise in attacks leveraging agentic tools and critical vulnerabilities, urgently requiring funding for foundational cybersecurity measures.
- HealthHealthcare organizations, already targeted by malicious campaigns, must strengthen protections against data breaches and supply-chain attacks.
- Public SectorAuthorities are calling for sector-wide safeguards, such as mandatory AI guardrails, to mitigate attack impacts and protect critical infrastructure.
This summary gives you the essentials. The full article, its figures and quotes are on Latent Space.
Read the original articleAI-generated summary of the source, checked by rules. How we write · Report an error