The Attack Surface Has Become Autonomous
Cybersecurity has entered a more unsettling phase. The newest danger is not simply that criminals are using artificial intelligence, but that they are delegating substantial parts of an attack to autonomous systems capable of searching, testing and adapting with limited human supervision.
On October 20, a Chinese-speaking criminal reportedly directed autonomous AI agents at more than 1,200 websites. The campaign reached sites associated with over 100 companies, including Deere, SharkNinja and Cummins.[3][7] The significance lies not only in the number of targets, but in the economics of the operation: an attacker no longer needs a large team of specialists to conduct reconnaissance across a broad digital landscape.
AI agents can work continuously, identify weaknesses and pursue several attack paths at once. That does not make them infallible, but it changes the balance between attacker effort and defender effort. A single exposed service can now attract automated attention from systems that never tire, never take holidays and can be rapidly reconfigured.
Businesses must therefore assume that internet-facing assets are being tested constantly. Security cannot depend on obscurity, infrequent audits or the hope that an attacker will overlook an outdated component.
Known Vulnerabilities Are Still Winning
The same week offered a reminder that sophisticated technology is not required to cause serious damage. The U.S. Cybersecurity and Infrastructure Security Agency added actively exploited vulnerabilities affecting Plex Media Server, Siemens Software Center and SiteGuard Server Edition to its Known Exploited Vulnerabilities catalogue.[1][2]
The Plex flaws, collectively called “Plex2Shell”, demonstrate how a chain of weaknesses can turn an exposed application into a route for deeper compromise. The SiteGuard vulnerability could allow operating-system commands to be executed with high privileges, while the Siemens flaw involves DLL sideloading.[1][2]
These are not abstract technical concerns. CISA’s catalogue exists because the vulnerabilities are being exploited in the real world. Federal agencies were given deadlines to apply mitigations, but the lesson extends well beyond government: organisations should treat exploited-vulnerability alerts as emergency operational instructions, not as routine patching news.
The continuing problem is not a lack of warnings. It is the distance between disclosure and remediation. Asset inventories remain incomplete, ownership is unclear and critical systems are often maintained by overstretched teams. Attackers exploit that administrative gap as readily as they exploit software flaws.
The Software Supply Chain Remains a Single Point of Failure
On October 19, OVHcloud’s command-line tool became the subject of a supply-chain compromise. An attacker reportedly took control of a contributor’s GitHub account and replaced download archives for five releases with malicious builds designed to steal secrets from affected machines.[5][8]
This type of attack undermines a basic assumption of modern computing: that software obtained from a recognised project is trustworthy. Developers may verify the project name and download location while overlooking whether the release itself has been altered.
The incident underlines the need for signed releases, reproducible builds, protected maintainer accounts and independent verification of artefacts. Multi-factor authentication is necessary, but it is not sufficient if one compromised identity can publish trusted-looking binaries. Organisations should also restrict the secrets available to command-line tools and monitor unusual access to credentials, tokens and configuration files.
Trust Is Becoming the Battlefield
The reported ConnectWise breach offers another warning. Attackers used a stolen ConnectWise Cloud Backup credential to reach 173 Microsoft 365 partner and customer tenants through a trusted backup application.[6][7] The attackers did not need to defeat every tenant individually. They exploited the relationships and permissions connecting them.
That is the defining feature of many contemporary breaches: the weakest link may be a supplier, contractor, backup service or software publisher rather than the organisation first named in the incident. Trust accelerates business, but inherited trust also accelerates compromise.
Espionage and Criminality Converge
Meanwhile, Russia-linked APT28 was associated with espionage attacks against a NATO-country naval shipbuilder, an aircraft-engine maker and a law-enforcement agency.[5][7] Such targeting shows that cyber operations remain instruments of national power, focused on industrial knowledge, defence capability and institutional access.
The conclusion is uncomfortable but clear. Cybersecurity is no longer a narrow IT responsibility. It is a discipline of operational resilience, supplier governance and national security. Organisations must patch exploited flaws quickly, authenticate software, limit third-party privileges and design systems on the assumption that trusted pathways may eventually be abused.
The future will belong not to those claiming perfect security, but to those capable of detecting compromise early, containing it decisively and recovering without surrendering their critical functions.