1. What has been happening?

October's wave of AI-enabled cybersecurity incidents have been termed by some "Black October" and exposed a growing challenge for software businesses: vulnerabilities that have survived years of development and scrutiny are now being uncovered at unprecedented speed.

Three developments from October illustrate the assumptions businesses need to revisit:

  • On October 21, researchers disclosed PHP2Shell, critical vulnerabilities in PHP, the widely used technology underpinning platforms such as WordPress and Drupal. According to Wiz, the vulnerable code had existed for more than a decade; AI helped a researcher turn those weaknesses into working exploits in a week. (Wiz)
  • On October 21, cloud development platform Railway disclosed a breach that exposed customer secrets and interrupted builds and deployments. Its preliminary investigation found that approximately 100,000 workspaces potentially had some environment variables compromised. (Railway)
  • On October 17, AI coding tool OpenCode disclosed a breach affecting 1.4% of users of its hosted Console service. Affected users had linked external AI providers and were notified to rotate their credentials. (OpenCode disclosure)

The implications go beyond cybersecurity teams. Software that was considered sufficiently scrutinized may no longer meet the same standard of security. And for businesses that operate on technology, this raises a more fundamental question: Are the assumptions underpinning how we build, buy and secure software still fit for purpose?

2. Why is this happening?

Examining unfamiliar code, identifying weaknesses and developing working exploits once required significant time and specialist expertise.

AI accelerates each of these steps, making more targets worth investigating and sophisticated attacks more accessible. Automated scanners can search large volumes of code, while coding agents can help identify vulnerabilities and develop ways to exploit them.

Some open-weight models themselves have undergone abliteration: modifications to internal representations that remove the built-in refusal mechanisms and safety guardrails without needing to retrain them. This does not add expertise or guarantee successful attacks, but it can remove friction that might otherwise interrupt malicious activity. (Research paper)

Together, automation and model availability weaken the assumption that attacking a company will require more effort than an adversary is willing to invest.

The silver lining is that AI changes the economics of defense too.

Businesses can use the same advances to inspect code, test applications, investigate findings, and verify fixes. Hosted and locally deployed models provide options when legitimate security testing requires keeping sensitive code within the company's environment.

3. Three security assumptions businesses need to rethink

"Open-source software gains security because anyone can inspect it."

  • Traditionally: Open-source software is inherently more secure because anyone can review the code, identify weaknesses and contribute fixes.
  • New reality: Available code is not necessarily reviewed code. A widely used project may depend on a few maintainers, while customers assume someone else has examined it.
  • What businesses should do: Evaluate evidence of review, maintenance, and secure releases alongside popularity. Use automated analysis to examine important dependencies and verify findings.

"Don't reinvent the wheel; reuse existing software."

  • Traditionally: Writing software was expensive. Reusing open-source libraries or integrating commercial platforms saved engineering time and provided capabilities a small team could not easily reproduce.
  • New reality: Libraries and vendors often do far more than a business needs, and one feature can bring dozens of dependencies and potential vulnerabilities. AI is reducing the cost of building narrower alternatives. As Mitchell Hashimoto has argued, "Blindly depending on trivial functionality or having a deep dependency tree causes more problems than it solves."
  • What businesses should do: Review your software stack and remove unnecessary dependencies. Selectively replace complex libraries or tools with simpler alternatives your team can maintain and secure. The goal is to reduce complexity without introducing new risks. Complicated or sensitive functionality, such as cryptography and networking, should remain with proven implementations.

"We're too small to be a target."

  • Traditionally: Startups delayed cybersecurity investments until there were more customers, more revenue, or an enterprise buyer demanding an audit.
  • New reality: Automated discovery makes small businesses more accessible and higher ROI targets. Exposed credentials (such as AI API keys), customer information, and access to other businesses can be valuable regardless of company size.
  • What businesses should do: Put security into everyday development. Automate code, dependency, and credential checks on every pull request through continuous integration. Run broader automated application tests daily and scoped penetration-testing workflows weekly against authorized environments. Match frequency to risk and runtime; a passing scanner is not a complete penetration test.

4. Build faster. Build more securely.

AI is changing the economics of software development, but the opportunity isn't simply to build more software, faster. It's to rethink how software is built, maintained and secured in the first place.

For growing companies, this means treating security as a core part of the development process rather than a problem to solve once the business scales. It also means questioning whether the complexity they've accumulated through years of software dependencies and third-party tools is still necessary.

For companies with established software infrastructure, the priority is different: understanding what you already have and where there could be risk. Review software dependencies, open-source libraries and third-party integrations for vulnerabilities, outdated components and unnecessary access. Years of accumulated technology can create complexity that is difficult to see, let alone secure.

At e52, we're interested in what becomes possible when AI-driven development is paired with more rigorous engineering: simpler systems, fewer dependencies and security built in from the start. We're also hiring engineers and researchers interested in building systems that are designed to withstand attack. If that's the kind of work you want to do, we'd love to hear from you.