Good morning, wonderful people. It’s an insane news morning after Anthropic finally filed for its IPO and Meta said it was looking to raise USD 95 bn in a series of rolling offerings, all while OpenAI is in the market with another big private raise for which it’s hoping to attract fresh capital from the UAE.
Oh, and Microsoft is offering buyouts to quarter of its global workforce, Oman is making a data center play, and Humain may have landed its first big offshore client.
We also have for you a deep dive into how AI might change credit decisions for personal and small business loans.
BUT FIRST- Sometimes, the only sane thing to do is to pull the plug. That’s the lesson of the last week or so as big organizations including the parent of Wikipedia, units of telecom giant Orange, European government agencies, and the Internet Archive took their websites offline as they scrambled to figure out how to patch a new security flaw.
Why go dark? The worry was that AI would help attackers exploit the vulnerability before the teams running the sites could get the fixes in.
AI nerds on X have taken to calling it Black October, saying the world is at a tipping point where attackers with AI can now overwhelm those whose job it is to keep our data safe and sites and apps online. The commentary has ranged from bog-standard advice about updating your systems to suggestions that you stockpile cash and food.
At the center of last week’s scare was something called PHP2Shell — flaws in PHP, a type of code that experts say is core infrastructure for something like 70% of the web, including WordPress and plenty of other websites and business applications. The exploits could let an attacker steal information or run their own code on an affected server. The PHP project released emergency fixes on 21 October, and it looks like they got there in time: I couldn’t find a single report of a site in MENA (or anywhere else) going down to a third-party attack.
If you’re like most businesses, your biggest vulnerability is probably sitting in a broom closet or a little-visited corner of your server room. Your head of IT knows which one, but if you’re poking your head in by yourself, it probably looks something like a rectangular server box with a sign on it that says something to the effect of “Important! Don’t shut down!” What does it do? What happens if you power it down? Who built it? Is s/he still alive? Who knows. (Tap or click here for a spoof so funny only because it’s so real and while you’re there, cue the Twitterbros.)
The bottom line: Someone needs to figure out why the server / service / whatever exists before you can make a decision to patch, rebuild, or switch it off. And you want to do that now, while you have the luxury of time, not after an attacker locks up your customer’s data.
AI is making it much easier for attackers to figure out how to get into your website and other systems. Here at EnterpriseAM, Joe has reported on how AI is also making factory machinery and power grids easier to hack. Sherif Shaltout (LinkedIn), managing executive for MENA at Liquid C2, told me earlier this week that vulnerabilities once considered theoretical or too hard to exploit now face “agents and tools that are relentless and have all the time in the world to figure it out.”
Your tech team may need some extra time to get its act together. Mario Tomić, our chief audience and technology officer, says there are literally thousands upon thousands of PHP applications still in service across our region still doing the one thing they were built to do years and years after they came into service. The operating system may no longer be supported, and updating PHP may require replacing the whole damn server. The Catch-22 is that if you do that, the old application might just … stop working.
“So you need to kind of throw away the whole thing and rebuild it,” Mario says. “Often, the old PHP code won’t work. For example, PHP 5 won’t work on PHP 8.”
That’s the challenge beyond this week’s patches. AI is speeding up the pace at which attacks are coming — and how quickly they’re executed — faster than most companies can identify weaknesses, figure out how to patch or replace systems, get the budget they need for the project, and deploy teams.
But waiting for the next emergency to show you what needs rebuilding could be an expensive bloody bet. Here’s what Sherif and Mario say you need to do next:
#1- Start with a map. Your team needs to know what software every part of your business runs on, where it lives, what it connects to, and who’s in charge of maintaining it, Mario says. “Don’t assume the map exists,” he adds. The map probably includes stuff you’ve bought and now integrate with as well as applications somebody built years ago. Cast a wide net: Shaltout describes companies that think they don’t use PHP because they use WordPress — which itself runs on PHP. He urges businesses to retire forgotten applications that no longer serve a purpose, focusing resources on maintaining only those things they really need and use.
#2- Give your CISO a proper budget. Pay for upgrades, replacements, and testing before an urgent fix forces you to choose between an exposed system and downtime for a critical part of your business. “It’s very hard to upgrade,” Tomic says of those older installations. Postponing the job won’t make the next emergency easier.
Uhm, Enterprise? You mean my Cisco? (IYKYK). No, I mean your chief information security officer — the person responsible for protecting your systems and data. If you’re asking and your business brings in more than a few tens of mns of AED a year, odds are good you’re underinvesting in cybersecurity. Read more about the role here.
And put more people on the problem. Shaltout’s warning is that AI needs experienced people directing it. “I think we need to find the balance between how quickly we fire people” — he laughs — “and how do we get them to guide AI to write that better software because it’s not going to do it on its own. You need to have the right people, and they need to have the right tools to defend.”
#3- No more box-ticking: Shaltout points out that too many businesses (particularly smaller institutions in regulated industries) have approached cybersecurity from a compliance point of view, meaning that, “you risk it becoming checkboxes and checklists and not fundamental questioning of systems and processes. It has to come from a risk-management point of view, not fear of a fine or a penalty from a regulator.”
Saudi businesses tend to be among the best in the region on cybersecurity, Shaltout adds, saying the National Cybersecurity Authority ensures that “everyone needs to submit a level of how compliant they are, regardless of their size, their industry.”
#4- Go hack yourself. Mario argues you run penetration tests against your own systems with capable open-source models. In practice, that usually means open-source and open-weight Chinese models, because frontier models from Anthropic and OpenAI generally refuse to look for vulnerabilities unless you’re an approved security researcher — they don’t know the difference between you testing your own systems and a hacker going after you. The idea is to find and fix weaknesses in your own systems before somebody else does, he says.
You don’t have to buy 100% of the “Black October” hype to act. Ask your team to figure out what that server does. Put somebody in charge and then pay for the upgrades. That sign on the door warning you not to turn off the box? It’s not a maintenance plan. –Patrick


