Earlier this year, I almost fell for an elaborate phishing attempt. It was convincing enough that I nearly went along with it. For an entire weekend I felt shame. Unfortunately, the latest “Black October” security findings suggest things are going to get worse. Old security flaws that once took too much time to exploit can now be targeted by 10k agents working overnight for the cost of a Pumpkin Spice Latte (okay... or two). A few things people much smarter than me have noticed over the past week: • Amazon spotted an attempted attack on website software four days before the public warning went out. The flaws could let someone take control without a password. Businesses were being targeted before they knew they needed a fix. • PHP, the software behind WordPress and many other websites, needed emergency fixes for two flaws that could let attackers take over servers without a login. Vercel added firewall protections before the public warning, but website owners still need to update PHP itself. • One of the secret keys used to help verify that websites are genuine was simply the number 4. Eight keys at certificate provider eMudhra were easy to guess. Updated browsers have protections, but older software may still trust the affected certificates. • NorForge researchers found criminals putting AI agents to work against online shops and payment systems. One group had more than 1,100 attack projects across its dashboards. • Quest Diagnostics, one of the biggest medical companies in the U.S., disclosed a breach this week and believes someone accessed patient records. It is still investigating how many people were affected. AI didn’t cause all of these failures. But it does make existing weaknesses cheaper to find and exploit. Not to play the doomer or alarmist, but now is a good time for a few reminders. -Use a password manager. -Turn on two-factor authentication. -If someone unexpectedly asks you to send money or download something, check through a number or account you already know. -Follow trusted security experts online. Working in tech or being chronically online doesn’t make you immune. Be safe out there.
