AI helped researchers expose critical weaknesses in software behind widely used websites, while separate investigations show criminals using AI agents to accelerate attacks.
Businesses need to know which systems are exposed and have people who can fix them quickly .
Emergency software updates and investigations into AI-assisted attacks are making cybersecurity an immediate business concern. On October 21, PHP patched two critical vulnerabilities in the programming language behind web software including WordPress. AI helped defensive researchers demonstrate how attackers could take control of affected servers without logging in.
Amazon detected attempted exploitation four days before the patches arrived. Whether those attempts succeeded against real systems remains unknown, as does whether the attackers used AI. The confirmed AI role in this case was helping researchers identify and demonstrate the danger.
Separately, Straiker documented CyberCartel's campaign against more than 400 financial targets across Latin America, using Claude and Grok agents. These AI agents carry out tasks autonomously across multiple steps. The 400 number refers to targets, not successful breaches.
CrowdStrike also documented data theft from South Korean financial organizations involving ARTEX, an AI-powered security-testing tool. Microsoft reported a China-aligned group targeting hundreds of organizations with ARTEX. Most attempts failed, but some gained high-level access to cloud systems in under three hours, and a ConnectWise compromise opened a route into customers' Microsoft 365 environments.
SmarterX founder and CEO Paul Roetzer broke down the business implications on Episode 248 of The Artificial Intelligence Show.
2 - Critical PHP vulnerabilities addressed in the security release
4 - Days between Amazon's earliest detected exploitation attempt and the PHP patches
400+ - Financial targets in CyberCartel's Latin America campaign
Under 3 - Hours to privileged cloud access in some Microsoft-reported attacks
Old software led to cyber vulnerability. As Roetzer puts it, "AI didn't create the problem." These flaws existed before AI uncovered their severity, affecting software businesses may rely on without knowing what runs underneath.
The business impact extends through vendors. ConnectWise illustrates how compromised software can provide a route into customers' systems. Leaders need to understand that dependence when they ask technical teams where they are exposed.
Defenders can use AI too. Roetzer pointed to Seer Interactive founder Wil Reynolds using AI to check client sites and identify vulnerable versions. He says, "That is maybe the best action you can take, is have outside partners or inside teams who act quickly based on AI."
"Find partners who can help you stay on top of this stuff, and then in your personal life, update everything, use two-factor authentication, use pass keys."
— Paul Roetzer, founder and CEO of SmarterX, Episode 248 of The Artificial Intelligence Show
Ask your team, hosting provider or agency whether the websites and services your business depends on use affected PHP versions, and whether fixes have been applied. Roetzer's own AI Academy briefly went offline because its provider chose to install patches. Timely protection can require accepting an interruption.
Give technical teams the support to act quickly, and follow through on basic account protection. Two-factor authentication adds a second verification step; passkeys let a trusted device authenticate a sign-in. Those habits matter at home, too, where reused passwords and postponed updates can leave accounts exposed.
Your own agents need scrutiny. AI assistants can visit websites and access information users did not anticipate, prompting Roetzer's warning: "The ability for it to now access something you would not want it accessing has just skyrocketed." Review what your agents can access and do on their own.
Applying fixes remains the practical test. The same tools that expose weaknesses can help defenders find and address them, giving technical teams a reason for optimism alongside the urgency. It's important to getting fixes into vulnerable systems, including older services an organization has forgotten it runs.
Only 48% of respondents say their organization has generative AI usage policies, according to the 2026 State of AI for Business Report. That finding measures a governance foundation, not protection against cyberattacks. It raises a related leadership question: as employees give AI more access to their work, has the organization made its expectations clear?
The report examines organizational readiness, adoption and governance across roles and industries. For leaders responding to these security incidents, it offers context for the internal decisions that accompany technical fixes: how AI is used, how people are trained and who guides adoption. Read the full report →