October brought a series of cybersecurity incidents that Ronaldo Lemos describes as a turning point. In his opinion column, he argues that artificial intelligence is speeding up the discovery of vulnerabilities and their use in attacks, making rapid responses essential for security teams.
The column recounts several events during the month. On October 6, JPMorgan’s president said the risk of cyberattacks had risen tenfold because of frontier AI. On October 12, an attack in France reportedly caused supermarket freezers to reach 50°C, resulting in food losses and small fires at several stores. The following day, JPMorgan blocked customer AI agents from accessing its systems, with other banks following suit.
On October 17, signs emerged of vulnerabilities in PHP, a widely used internet infrastructure. The flaws, known as PHP2Shell, could allow code to run on a server without a login. Their existence was disclosed publicly on October 20, when fixes were also made available. Lemos says the vulnerabilities had existed for 14 years and that AI contributed to their discovery, exploitation and correction.
Authorities and organizations moved to apply the fixes. The Netherlands took its digital identity website offline, while Finland and France did the same with government websites. In Brazil, Anatel and several courts suspended services until patches were applied. Lemos warns that systems left unpatched remain at serious risk.
Further incidents followed. On October 23, a US cybersecurity expert reportedly said that 3% of all vulnerabilities in digital history had occurred in the previous 30 days. The column says attacks around the world then prompted companies and users to replace digital keys and take emergency measures.
Lemos also reports that Binance disclosed on October 29 that an attack had diverted US$6.3 billion in cryptocurrency. The company suspended withdrawals while investigating, affecting users worldwide, including in Brazil. The incident was attributed to an attack on an internal developer’s laptop, which Lemos says raises questions about how a single device could provide access to such a large amount of users’ funds.
Lemos argues that October should not be treated as an isolated episode. He warns that AI-enabled attacks could put Brazilian government systems and critical infrastructure, including Pix, at risk, and says the country needs to take its cybersecurity weaknesses seriously.
Sources: Folha Mercado.